{"id":"kadnap-asus-router-botnet-proxy-mar-2026","category":"breach","status":"closed","title":"KadNap botnet hijacks more than 14,000 ASUS routers and other devices to sell as criminal proxies","tldr":"KadNap malware has infected 14,000+ devices, mainly ASUS routers, and resells them as criminal proxies. About 60% are in the US. No takedown or ASUS fix was found in our search. Reboot, update firmware, change passwords, close remote admin, replace end-of-life routers.","summary":"KadNap is malware that turns home and office routers into a hidden network used to relay other people's traffic. Lumen's Black Lotus Labs disclosed it on 10 March 2026, saying it had tracked the botnet since August 2025 and was seeing about 14,000 infected devices a day. ASUS routers are the main target, but other network-edge devices are also infected. More than 60% of victims are in the United States, with Taiwan, Hong Kong and Russia each around 5%. Access to the devices is sold through a proxy service called Doppelganger, which Lumen believes is linked to the earlier Faceless service. Buyers use it to hide attacks such as password guessing. KadNap hides its control servers inside a peer-to-peer network, which makes it harder to shut down. Neither Lumen nor BleepingComputer named a specific software flaw or an ASUS firmware fix. Lumen blocked the botnet's traffic only on its own network. Our search found no report of a wider takedown, so the botnet's current state is not confirmed.","action":"Reboot your router, install the latest firmware, replace it if it is no longer supported, and change any default password. Make sure its admin page is not reachable from the internet. If you can't do this yourself, ask whoever set up your network.","product":"ASUS routers and other home and small-office network devices","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["botnet","kadnap","asus","router","proxy","doppelganger","lumen","iot"],"affected":["ASUS routers (primary target; specific models not listed in the sources read)","Other edge networking devices (ARM and MIPS)"],"fixed":[],"matches":[],"sources":[{"kind":"research","title":"Silence Hops: the KadNap botnet","url":"https://www.lumen.com/blog/en-us/silence-hops-kadnap-botnet","by":"Lumen Black Lotus Labs","date":"2026-03-10"},{"kind":"news","title":"New KadNap botnet hijacks ASUS routers to fuel cybercrime proxy network","url":"https://www.bleepingcomputer.com/news/security/new-kadnap-botnet-hijacks-asus-routers-to-fuel-cybercrime-proxy-network/","by":"BleepingComputer","date":"2026-03-10"}],"started":"2026-03-10","closed":"2026-03-10","created":"2026-11-03T21:31:53.288Z","updated":"2026-11-03T21:31:53.288Z","cve_notes":[],"timeline":[{"at":"2026-03-10","added":"2026-11-03T21:28:26.316Z","kind":"other","text":"BleepingComputer reported that access to the infected devices is sold through the Doppelganger proxy service, which researchers believe is a rebrand of the earlier Faceless service. Lumen blocked traffic to and from the botnet's control servers on its own network only, and the report mentioned no ASUS firmware fix.","url":"https://www.bleepingcomputer.com/news/security/new-kadnap-botnet-hijacks-asus-routers-to-fuel-cybercrime-proxy-network/","by":"BleepingComputer","patch":"na"},{"at":"2026-03-10","added":"2026-11-03T21:28:26.316Z","kind":"disclosed","text":"Lumen's Black Lotus Labs published its findings on KadNap, a botnet of more than 14,000 infected devices, mostly ASUS routers and other edge networking gear. Lumen said it had tracked the network since August 2025 and that over 60% of victims were in the United States.","url":"https://www.lumen.com/blog/en-us/silence-hops-kadnap-botnet","by":"Lumen Black Lotus Labs","patch":"na"}],"url":"https://hard.fyi/live/kadnap-asus-router-botnet-proxy-mar-2026/","json":"https://hard.fyi/api/live?id=kadnap-asus-router-botnet-proxy-mar-2026"}