14,000 routers are infected by malware that’s highly resistant to takedowns

Security researchers at Lumen's Black Lotus Labs have identified a botnet called KadNap infecting approximately 14,000 routers daily, up from 10,000 last August. The majority of compromised devices are Asus routers, likely targeted via known unpatched vulnerabilities. What makes KadNap particularly notable is its use of a Kademlia-based peer-to-peer architecture with distributed hash tables (DHTs) to hide command-and-control server IPs, making it highly resistant to traditional detection and takedown methods. Infected devices are primarily located in the US and are used as anonymous proxies for cybercrime traffic.