# KadNap Botnet: ASUS Routers Hijacked for Faceless Proxy Network

> The KadNap botnet hijacks ASUS routers via CVE-2024-3080 to fuel the Faceless proxy service, enabling cybercriminals to mask traffic through residential IPs.

- Published: 2026-03-10T16:28:40.000Z
- Severity: high
- Category: Malware
- Tags: KadNap, ASUS, CVE-2024-3080, Botnet, Proxy as a Service
- Author: Runtime Rebel Intel
- Primary source: https://www.bleepingcomputer.com/news/security/new-kadnap-botnet-hijacks-asus-routers-to-fuel-cybercrime-proxy-network/
- Canonical: https://runtimerebel.com/blog/kadnap-botnet-asus-routers-hijacked-for-faceless-proxy-network

## Key points

- KadNap botnet hijacks ASUS routers to facilitate illegal proxy traffic for cybercriminals, masking malicious activities behind residential IP addresses.
- Impacted hardware includes several ASUS router models, including the RT-AX88U and RT-AX58U, running vulnerable firmware versions.
- Organizations must immediately update ASUS router firmware to the latest versions and disable remote management features to block exploit attempts.

Recent cybersecurity investigations have uncovered a sophisticated malware botnet dubbed KadNap, which specifically targets ASUS routers to integrate them into a massive residential proxy network. According to [BleepingComputer](https://www.bleepingcomputer.com/news/security/new-kadnap-botnet-hijacks-asus-routers-to-fuel-cybercrime-proxy-network/), the botnet facilitates the operations of 'Faceless,' a known cybercrime proxy service that allows threat actors to route malicious traffic through legitimate home networks. By hijacking these devices, attackers can bypass geolocation-based security controls and perform activities such as credential stuffing, [Phishing](/glossary#phishing), and [DDoS](/glossary#ddos) attacks while appearing as domestic residential traffic.

## Technical Analysis: Faceless Proxy Network Analysis

The KadNap malware is a custom-developed [TTP](/glossary#ttp) that utilizes the Kademlia (Kad) distributed hash table for decentralized discovery. This allows the botnet to maintain a resilient [C2](/glossary#c2) infrastructure without relying on centralized servers that are easily taken down by law enforcement. Upon infection, the malware identifies the device's external IP address and establishes communication with other peers in the Kad network.

The primary objective of KadNap is to turn the compromised router into a SOCKS5 proxy. This transformation is achieved by manipulating the device's internal routing tables and opening ports using UPnP (Universal Plug and Play) or manual configuration via the router's shell. Once the proxy is active, it reports back to the Faceless backend, making the router's bandwidth available to paying customers of the proxy service. This specific **Faceless proxy network analysis** suggests that the operators are highly focused on maintaining a high-quality pool of residential IPs to maximize the anonymity of the traffic for their clients.

## Exploitation of CVE-2024-3080 in ASUS Hardware

The botnet primarily propagates by exploiting a critical [CVE](/glossary#cve) identified as [CVE-2024-3080](https://nvd.nist.gov/vuln/detail/CVE-2024-3080). This vulnerability is an unauthenticated [RCE](/glossary#rce) flaw that allows an attacker to execute arbitrary commands on the target router. The [CVSS](/glossary#cvss) score for this vulnerability is 9.8, indicating its critical nature and ease of exploitation.

Affected devices include popular consumer and small-office models:
- RT-AX88U
- RT-AX58U
- RT-AX86U
- RT-AC68U

Attackers scan the internet for routers with exposed management interfaces. Once a vulnerable device is found, they use an exploit payload to gain initial access and achieve [Privilege Escalation](/glossary#privilege-escalation). From there, the KadNap binary is downloaded and executed in memory or persisted within the `/jffs/` partition, a common storage area for custom scripts on ASUS routers. This persistence ensures that the malware remains active even after a reboot, which is a standard [MITRE ATT&CK](/glossary#mitre-att-ck) technique for maintaining long-term access.

## ASUS Router CVE-2024-3080 Remediation and Detection

To defend against this threat, network administrators and home users must prioritize **ASUS router CVE-2024-3080 remediation** steps immediately. The most effective mitigation is the installation of the latest firmware updates provided by the manufacturer. ASUS has released patches for all affected models that specifically address the RCE vulnerability.

In addition to patching, defenders should implement the following security measures:
- Disable WAN-side access to the router’s administration web interface.
- Disable UPnP if it is not strictly necessary for network operations.
- Use unique, high-entropy passwords for all administrative accounts.
- Implement a [Zero Trust](/glossary#zero-trust) approach by restricting internal network access from edge devices.

### How to Detect KadNap Botnet Activity

For [SOC](/glossary#soc) analysts and incident responders, identifying compromised hardware involves monitoring for specific network anomalies. **How to detect KadNap botnet** infections typically involves looking for high volumes of UDP traffic on non-standard ports, which is characteristic of Kademlia DHT overhead. Furthermore, unusual outbound connections to known Faceless infrastructure or an influx of SOCKS5 proxy traffic originating from the router's IP address serve as strong [IoC](/glossary#ioc) indicators. If a compromise is suspected, administrators should check for unauthorized scripts in the `/jffs/scripts/` directory and review system logs for unrecognized logins. 

The rise of KadNap highlights the ongoing trend of targeting edge devices to facilitate large-scale cybercrime operations. As these devices often lack traditional [EDR](/glossary#edr) or [SIEM](/glossary#siem) visibility, they remain a preferred target for [APT](/glossary#apt) groups and profit-motivated actors alike.

**Related:** [KadNap Malware: 14,000 Asus Routers Enlisted in Stealth Proxy Botnet](/blog/kadnap-malware-14000-asus-routers-enlisted-in-stealth-proxy-botnet), [Redis RCE Threats Amidst Broader Cyber Landscape](/blog/redis-rce-threats-amidst-broader-cyber-landscape)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/kadnap-botnet-asus-routers-hijacked-for-faceless-proxy-network