KadNap Botnet Targets Asus Routers with Stealthy Proxy Network

A sophisticated modern botnet dubbed KadNap is exploiting vulnerabilities in Asus routers and other edge networking devices, transforming them into a stealthy proxy network used for malicious cyber activity. The botnet, which has grown to over 14,000 infected devices since August 2025, utilizes a unique peer-to-peer architecture to evade detection and disrupt traditional network monitoring.

How KadNap Operates

KadNap distinguishes itself through its innovative use of a custom version of the Kademlia Distributed Hash Table (DHT) protocol. This protocol conceals the IP addresses of the botnet’s command-and-control (C2) servers within a peer-to-peer system, making it significantly harder for security professionals to identify and block the infrastructure. Lumen’s Black Lotus Labs first discovered the botnet and has been tracking its growth.

Unlike traditional botnets with centralized control, KadNap’s decentralized design allows infected devices to locate and connect with C2 servers without relying on a fixed list of IP addresses. This resilience is achieved by using distributed hash tables, where nodes poll each other for the location of desired devices or servers, substituting IP addresses with hashes. This approach mirrors the functionality of well-known peer-to-peer networks like BitTorrent and the Inter-Planetary File System.

Geographic Distribution and Target Devices

The majority of KadNap infections are located in the United States, with significant concentrations also found in Taiwan, Hong Kong, and Russia. The Hacker News reports that while Asus routers are the primary target, KadNap operators have been observed deploying the malware against a variety of edge networking devices.

The Doppelgänger Proxy Service

Once a device is compromised, access to it is sold through a proxy service called Doppelgänger (doppelganger[.]shop). Doppelgänger, which launched in May/June 2025, is believed to be a rebranding of the Faceless proxy service associated with TheMoon malware. The service advertises resident proxies in over 50 countries, promising “100% anonymity” to its customers. SCWorld highlights that these proxies are frequently used for malicious activities such as DDoS attacks, credential stuffing, and brute-force attacks.

Infection Process

The infection process begins with the download of a shell script (“aic.sh”) from the C2 server (212.104.141[.]140). This script initiates the process of conscripting the victim device into the peer-to-peer network. Bleeping Computer details that the script establishes persistence and installs an ELF binary, which then contacts NTP servers and utilizes the modified Kademlia DHT to locate botnet nodes and C2 servers.

Mitigation and Response

Lumen Technologies has taken steps to block traffic to KadNap’s control infrastructure on its network. However, broader disruption requires widespread adoption of indicators of compromise and collaborative efforts across the cybersecurity community.