KadNap botnet hijacks more than 14,000 ASUS routers and other devices to sell as criminal proxies
KadNap malware has infected 14,000+ devices, mainly ASUS routers, and resells them as criminal proxies. About 60% are in the US. No takedown or ASUS fix was found in our search. Reboot, update firmware, change passwords, close remote admin, replace end-of-life routers.
Reboot your router, install the latest firmware, replace it if it is no longer supported, and change any default password. Make sure its admin page is not reachable from the internet. If you can't do this yourself, ask whoever set up your network.
What’s happening
KadNap is malware that turns home and office routers into a hidden network used to relay other people's traffic. Lumen's Black Lotus Labs disclosed it on 10 March 2026, saying it had tracked the botnet since August 2025 and was seeing about 14,000 infected devices a day. ASUS routers are the main target, but other network-edge devices are also infected. More than 60% of victims are in the United States, with Taiwan, Hong Kong and Russia each around 5%. Access to the devices is sold through a proxy service called Doppelganger, which Lumen believes is linked to the earlier Faceless service. Buyers use it to hide attacks such as password guessing. KadNap hides its control servers inside a peer-to-peer network, which makes it harder to shut down. Neither Lumen nor BleepingComputer named a specific software flaw or an ASUS firmware fix. Lumen blocked the botnet's traffic only on its own network. Our search found no report of a wider takedown, so the botnet's current state is not confirmed.
- What
- Breach
- Affects
- ASUS routers and other home and small-office network devices
- Affected
- ASUS routers (primary target; specific models not listed in the sources read)
Other edge networking devices (ARM and MIPS) - Fixed in
- Nothing to patch
- Since
- 10 Mar 2026
- Closed
- 10 Mar 2026
Timeline
- UpdateNothing to patch
BleepingComputer reported that access to the infected devices is sold through the Doppelganger proxy service, which researchers believe is a rebrand of the earlier Faceless service. Lumen blocked traffic to and from the botnet's control servers on its own network only, and the report mentioned no ASUS firmware fix.
- Made publicNothing to patch
Lumen's Black Lotus Labs published its findings on KadNap, a botnet of more than 14,000 infected devices, mostly ASUS routers and other edge networking gear. Lumen said it had tracked the network since August 2025 and that over 60% of victims were in the United States.
Sources
- Silence Hops: the KadNap botnetLumen Black Lotus Labs · 10 Mar 2026
- New KadNap botnet hijacks ASUS routers to fuel cybercrime proxy networkBleepingComputer · 10 Mar 2026