New KadNap Malware Compromises 14,000+ Edge Devices to Build Stealth Proxy Botnet

What happened:

Security researchers have uncovered a new malware strain called KadNap that has infected more than 14,000 edge networking devices, primarily consumer routers such as ASUS models, hijacking them to form a decentralized proxy botnet that conceals malicious traffic and evades detection. 

Who is affected:

The majority of compromised devices are located in the United States, but infections have also been identified in Europe, Asia, and Australia. The malware targets small office/home office (SOHO) routers and other edge hardware running common processor architectures.

Why CISOs should care:

KadNap represents a growing botnet threat that leverages decentralized peer‑to‑peer control using a custom implementation of the Kademlia Distributed Hash Table (DHT) protocol, making conventional detection and takedown efforts difficult. Once enlisted, devices act as stealth proxies that can mask malicious activity, undermining network visibility and potentially contributing to broader cybercrime operations.

3 practical actions:

1. Audit and update: Inventory and patch all edge networking devices, ensuring firmware is current and supported. 
2. Harden access: Disable remote management, change default credentials, and enforce strong authentication for all SOHO and enterprise edge devices.
3. Network monitoring: Implement advanced anomaly detection on north‑south and east‑west traffic to identify unusual proxying or peer‑to‑peer patterns indicative of DHT botnets.