News Summary

A sophisticated malware strain named KadNap has infected approximately 14,000 routers, primarily Asus models, and integrated them into a botnet that is notably resistant to takedowns. This botnet, uncovered by security researchers at Lumen’s Black Lotus Labs, exploits known vulnerabilities in these routers to create a proxy network used for cybercrime. KadNap’s peer-to-peer network design, based on distributed hash tables, makes it exceptionally difficult to detect or dismantle, as it substitutes IP addresses with hashes to enhance resilience against traditional takedown methods. The malware persists even after infected routers are restarted, necessitating a full factory reset to remove it entirely. The KadNap botnet primarily operates in the US, with smaller numbers in Taiwan, Hong Kong, and Russia, and supports anonymous proxies for cybercriminal activities.