KadNap Botnet Analysis: How 14,000 ASUS Routers Got Turned Into a Criminal Proxy Network

By Kim Njuki April 15, 2025 Updated: August 25, 2026 5 min read

If you own an ASUS router, sit down for a minute. Because what security researchers revealed in March 2026 isn't the typical 'update your firmware' advisory that usually gets safely ignored. It's a documented, still-active criminal operation that has already compromised more than 14,000 devices — more than 60 percent of them in the United States — and whose architecture was deliberately designed to survive attempts to shut it down.

Meet KadNap. And understand why it matters.

Who Found It and What They Found

The disclosure came from Black Lotus Labs, the threat research and operations arm of Lumen Technologies, published on March 10 and 12, 2026. Researchers had been tracking the malware since August 2025, when the botnet first appeared in the wild. By the time they published, the network had expanded to over 14,000 infected devices, with the infection count growing since the initial detection.

KadNap is primarily a botnet for proxying — not for direct attacks. Infected routers are silently enrolled into a peer-to-peer network, after which their internet connections are sold to cybercriminals as residential proxies. Those proxies are then used to route malicious traffic, conduct credential stuffing campaigns, launch DDoS attacks, and evade IP-based blocklists. The victims whose routers are doing this work have no idea it's happening.

Black Lotus Labs linked KadNap directly to a criminal proxy service called Doppelganger, operating at doppelganger[.]shop, which advertises proxies in over 50 countries with claims of complete anonymity. The service is believed to be a rebrand of an older operation called Faceless, which was previously connected to the TheMoon malware botnet. TheMoon also targeted ASUS hardware specifically. There's a pattern here worth noting.

The Technical Architecture: Why This One Is Dangerous

Most botnets use centralized command-and-control servers. A handful of servers direct all infected devices. That architecture has a known weakness: find the servers, seize them, and the botnet collapses. Law enforcement and security companies have dismantled dozens of botnets this way.

KadNap was built to prevent exactly that. It uses a customized version of the Kademlia Distributed Hash Table (DHT) protocol — the same foundational architecture that powers BitTorrent and the InterPlanetary File System — for all C2 communications. The name KadNap comes from this Kademlia implementation.

In a DHT-based network, there is no central server. Information about the network topology is distributed across all participating nodes. Each node knows about its neighbors in the 160-bit DHT address space. When a device needs to locate the C2 infrastructure, it begins at a BitTorrent bootstrap node and follows a series of DHT lookup hops — getting progressively closer to the target identifier — until it reaches a node that responds with the actual C2 address.

The practical effect: defenders cannot simply identify the C2 servers, add them to blocklists, and watch the botnet die. With no central point of failure, the network degrades gracefully as nodes are removed. Taking down ten percent of the infected devices has minimal impact on the remaining ninety percent.

Black Lotus Labs researcher Chris Formosa described the process in plain terms to Ars Technica: the infected device basically issues a challenge passphrase to a series of DHT neighbors, moving closer with each hop until it reaches someone who says yes, this is my passphrase — here is the C2 address.

The Infection Chain

The attack exploits known but unpatched vulnerabilities in specific ASUS router models. No zero-days are involved. Just old holes that owners never bothered to close.

Once initial access is established, a shell script called aic.sh is downloaded from the C2 server. This script creates a cron job that runs every hour at the 55-minute mark. The cron job renames the script to .asusrouter — blending it into what looks like a legitimate ASUS router process — and executes it. The script then pulls a malicious ELF binary, renames it to kad, and runs it.

At that point, the device is fully enrolled. The malware determines the router's external IP address, queries NTP servers for current time and system uptime, generates identifying hashes from that data, and uses those hashes to locate its position in the DHT network and find its assigned C2 server.

KadNap targets both ARM and MIPS processor architectures, covering the range of chipsets in ASUS consumer routers. Nearly half of infected devices connect to C2 infrastructure specifically dedicated to ASUS-based bots; the remainder communicate with separate servers handling other device types.

Geographically, the US accounts for roughly 60 percent of infections, with additional concentrations in Taiwan, Hong Kong, Russia, the UK, Australia, Brazil, France, Italy, and Spain.

What Lumen Did About It

Lumen has blocked all network traffic to and from KadNap's control infrastructure on its own network and has committed to publishing indicators of compromise into public feeds so that other network operators can implement equivalent blocking. That disruption is significant but limited: it only protects traffic flowing through Lumen's infrastructure.

A full factory reset — not just a reboot — is required to remove the infection from a compromised router. A simple restart does not eliminate KadNap's persistence mechanisms, which survive the power cycle via the cron job installation.

What You Should Do

If you run an ASUS router, check your firmware version against the current release on ASUS's official support site and apply any outstanding updates immediately. Change your router admin password if you haven't recently — and ensure it's not accessible over the public internet. Disable remote management unless you have a specific operational need for it.

If you notice sustained upload activity, sluggish internet performance, or unusual traffic patterns, do not assume it's your ISP. Log into your router's admin interface and check for unfamiliar scheduled tasks or processes. If anything looks wrong — especially a cron job running at the 55-minute mark — perform a full factory reset, update firmware before reconnecting, and change all associated passwords.