Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
61 IOCs
More Than 4,000 Legacy Routers Compromised by AryStinger, Turned into Global Attack Proxies for Hackers
Malware Families
Excerpt
Background On May 20, 2026, the Ministry of State Security's WeChat official account published an article "Your internet is slow, and the culprit turns out to be this!" , highlighting that outdated routers are becoming a key entry point for threat actors to conduct cyber espionage. Inspired by this article, we feel it is imperative to take the compromise of old routers seriously. This article introduces an unusual attack campaign observed within QiAnXin…
Read the original report →Diamond Model
Adversary
Infrastructure(5)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →61 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | d997efa98afab2c003654b8d5ce2bedf | High | Score 56/100 | First seen |
| MD5 | d79270ba44e665ebb0383eb77a52e38b | High | Score 56/100 | First seen |
| URL | https://hgodpcx.ajb8.com/prod/standard/ | High | Score 58/100 | First seen |
| MD5 | e9916ff56074725f5739ead5091fe6c7 | High | Score 56/100 | First seen |
| MD5 | 18f894a3168ee0b809eed321a2e748b4 | High | Score 56/100 | First seen |
| MD5 | 9660895fa3fcabbef466703636f6d51d | High | Score 56/100 | First seen |
| MD5 | d2fd89ebdad493ec9ac76ce35213cec4 | High | Score 56/100 | First seen |
| MD5 | b9406e969cdfdaef433e93d0b9ad1f5d | High | Score 56/100 | First seen |
| MD5 | 98e55d712a99d2cd45e8592c6dda5110 | High | Score 56/100 | First seen |
| MD5 | 6869f24aecd75e2144aba8dc03dc2d0f | High | Score 56/100 | First seen |
| MD5 | abae20b26b70b526bebb5e2617092ede | High | Score 56/100 | First seen |
| MD5 | 7461445fca3f9d8911148e0908d33c3b | High | Score 56/100 | First seen |
| MD5 | 6f761f63642cd6329a29cfad80be50c3 | High | Score 56/100 | First seen |
| MD5 | 8edb3ea62a7e643ba1a88d20799cf94f | High | Score 56/100 | First seen |
| MD5 | 36ff9f683e870145aaf5a715bc934762 | High | Score 56/100 | First seen |
| MD5 | 0627f034c42549e2130734b5f8dbf854 | High | Score 56/100 | First seen |
| MD5 | 8deb2a60d42de0f8f8786e485d2f046f | High | Score 56/100 | First seen |
| MD5 | 7b361a6d0d42309d09ec9000b53712b3 | High | Score 56/100 | First seen |
| CVE | CVE-2013-3307 | High | Score 63/100 | First seen |
| MD5 | 19232d0eff3ef7aee3b5d7620c72358c | High | Score 56/100 | First seen |
| MD5 | 44805c4b36bd3d97ba8ecaf6fe103572 | High | Score 56/100 | First seen |
| MD5 | fffcbd0ac2cb545496890f50395181ff | High | Score 56/100 | First seen |
| MD5 | a3181550e0e0a6153a44b7a0495535b0 | High | Score 56/100 | First seen |
| MD5 | ea2fe3b409da439aec25cf7eabf5b7a7 | High | Score 56/100 | First seen |
| MD5 | 4c80d17fa5db5b1c2aaddb5351e9cb6b | High | Score 56/100 | First seen |
| MD5 | a97e552f5e655e1cfa56853f65beeb0e | High | Score 56/100 | First seen |
| CVE | CVE-2025-11837 | Medium | Score 56/100 | First seen |
| CVE | CVE-2016-5681 | Medium | Score 56/100 | First seen |
| MD5 | a2d54fcd0c2816f607a5962523fc648c | High | Score 56/100 | First seen |
| MD5 | a3e3197e2344c51e95c063541ea22205 | High | Score 56/100 | First seen |
| MD5 | ed9209111b995cbe78f8e097c289f127 | High | Score 56/100 | First seen |
| MD5 | 0ffb4b4e430f4b69216fb9d2e082e482 | High | Score 56/100 | First seen |
| MD5 | 10ba24db187836efe77ed7e75d279d33 | High | Score 56/100 | First seen |
| MD5 | 05627d1bddb7292bb45139244f46051f | High | Score 56/100 | First seen |
| MD5 | 0a2d2a4ec1ca2aa6a23a35abb5a75451 | High | Score 56/100 | First seen |
| MD5 | ff11e000f377c54dea928b09ebad9df8 | High | Score 56/100 | First seen |
| URL | http://hgodpcx.ajb8.com | Medium | Score 43/100 | First seen |
| MD5 | 5d9cdb072415b191df3f444f53b2ff4b | High | Score 56/100 | First seen |
| MD5 | f093891e281bcd9c8016dea7d89cc671 | High | Score 56/100 | First seen |
| URL | https://hgodpcx.ajb8.com/prod/RTL819X/ | High | Score 58/100 | First seen |
| URL | https://hgodpcx.ajb8.com/n | High | Score 58/100 | First seen |
| MD5 | dd1e5a3cd9f842bd70be45a62c3ebbf6 | High | Score 56/100 | First seen |
| MD5 | a5101caf0a1789d6a4bc30e644d6b152 | High | Score 56/100 | First seen |
| MD5 | b0f4f813a9de094c06821366e2459aee | High | Score 56/100 | First seen |
| MD5 | c113739225ece5f6e4805466dec1401d | High | Score 56/100 | First seen |
| MD5 | 8cc249b16adf7e4a658af7fa31d7998e | High | Score 56/100 | First seen |
| MD5 | fc4cee066d8526f5806bb23278f647da | High | Score 56/100 | First seen |
| MD5 | fcc9de5c040307e6ac3011e8b379f6d9 | High | Score 56/100 | First seen |
| MD5 | 9973676bfa9fe89aa5c76e3cd0b21ae8 | High | Score 56/100 | First seen |
| MD5 | 16fed5909de4f50351fc33fbfcf156df | High | Score 56/100 | First seen |
| MD5 | dbcc5a3e6afe41060d6357e24dc03fd3 | High | Score 56/100 | First seen |
| MD5 | df0c9f6289e56f31c0700f40590857d3 | High | Score 56/100 | First seen |
| MD5 | dc35086ba0f5f83545c32a023a1f3be4 | High | Score 56/100 | First seen |
| MD5 | 7f2b2e3516fa454adfd51f857ae80adf | High | Score 56/100 | First seen |
| MD5 | b104a05e8a2e218adfb7654ba8bf3d49 | High | Score 56/100 | First seen |
| MD5 | 6f91d1f8f0cbaab137351936b52f7a94 | High | Score 56/100 | First seen |
| MD5 | e6b27080aa1ce1901a23dd75716d9092 | High | Score 56/100 | First seen |
| MD5 | dc71c10ca0b2c83b6b3a6a062fca314f | High | Score 56/100 | First seen |
| URL | http://hgodpcx.ajb8.com/prod/RTL819X/ | High | Score 58/100 | First seen |
| MD5 | 9221423d7daff9e64f7e2af54f911fea | High | Score 56/100 | First seen |
| MD5 | dbdd4d8e4aef3ce69cf65ed470425c89 | High | Score 56/100 | First seen |
IOC Relationship Graph
Building graph…