14,000 routers are infected by malware that’s highly resistant to takedowns

In a significant security breach, researchers have identified a robust botnet comprising 14,000 routers and various network devices, predominantly manufactured by Asus. This network has been repurposed into a proxy system that facilitates anonymous cybercriminal activities. The malware, identified as KadNap, exploits unpatched vulnerabilities within these devices, according to Chris Formosa, a researcher at Lumen’s Black Lotus Labs. The prevalence of Asus routers within this botnet likely stems from operators leveraging a reliable exploit targeting known vulnerabilities in these models. Formosa indicated that the attackers are not utilizing any zero-day exploits in this operation. The infection rate has surged, with an average of 14,000 routers compromised daily, up from 10,000 reported last August when Black Lotus first detected the botnet. The majority of the infected devices are situated in the United States, with smaller numbers found in Taiwan, Hong Kong, and Russia. A key characteristic of the KadNap botnet is its advanced peer-to-peer architecture, inspired by Kademlia, which employs distributed hash tables to obscure the IP addresses of its command-and-control servers. This innovative design enhances the botnet's immunity to conventional detection and mitigation strategies. Formosa and fellow researcher Steve Rudd highlighted that the KadNap botnet distinguishes itself from others supporting anonymous proxies through its use of a decentralized control mechanism. Their objective is evident: to evade detection and complicate defense efforts. The utilization of distributed hash tables, a technology also seen in systems like BitTorrent and the Inter-Planetary File System, allows for a network where any node can search for other nodes without relying on centralized servers. This decentralized framework, coupled with the replacement of IP addresses with hashes, provides the network with a formidable resilience against takedown attempts and denial of service attacks.