What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Lumen’s Black Lotus Labs reported on March 10, 2026, that KadNap was infecting an average of 14,000 distinct devices per day. Asus routers were the primary targets, but the report also identified other edge networking devices. The figure is a researcher estimate from that reporting period—not a live count or proof that every infected device was an Asus router.
What the KadNap report found
Black Lotus Labs said its monitoring began after its detection algorithm found more than 10,000 Asus devices communicating with a particular set of servers in early August 2025. By its March 2026 report, the lab’s telemetry indicated a daily average of 14,000 distinct victims. It said more than 60% were in the United States. These figures describe Lumen’s observations and methodology, not an independently verified census of every infected device. Lumen / Black Lotus Labs report
KadNap enrolls routers and other edge devices in a botnet, a network of compromised devices controlled for malicious purposes. According to Lumen, the operators marketed access to infected devices through a proxy service called Doppelganger. The lab assessed that Doppelganger was likely a rebrand of the defunct Faceless service, which had been powered by TheMoon malware; that relationship is an analytical assessment, not a legal finding.
How KadNap operates and persists
Lumen reported that KadNap uses a custom version of Kademlia, a distributed hash table (DHT) protocol. In this design, infected devices use peer-to-peer communication to find peers and command-and-control infrastructure. Distributing discovery this way can make infrastructure harder to identify and block than a conventional centralized command server.
Recommended Free Tools
#1 Best Overall
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
In the samples it analyzed, Lumen found an hourly cron job—a scheduled task—that retrieved a malicious script. The script was saved as .asusrouter in /jffs/, after which a malicious binary renamed kad was downloaded and run. The report also described two long-lived intermediary nodes observed between victims and the command infrastructure. These details describe analyzed samples; they do not establish that every infected router has identical files or configuration.
How to check and respond if you own an Asus router
The public sources do not provide a confirmed list of affected router models, a KadNap-specific vulnerable firmware list, or a proven initial-access vulnerability. The Cloud Security Alliance characterized credential-based entry as an assessment, not a confirmed vulnerability attribution. Do not assume that a particular CVE or router model is responsible. Cloud Security Alliance analysis
Rank #2
- Beyond-fast WiFi 7 (802.11be) with new 320MHz channels in the 6 GHz band and 4096-QAM significantly increases network capacity and throughput, with speeds of up to 30 Gbps
- Multi-link Operation links to multiple bands at the same time to ensure stable internet connections and efficient data transfers
- Cutting-edge external dual-feeding antennas boost coverage by providing high efficiency and significantly enhanced signal strength
- Maximized wired connectivity and flexibility with dual 10G ports and quad 2.5G ports
- Triple-Level Game Acceleration - The GT-BE98 Pro boosts your PC gaming traffic every step of the way, from your PC gaming port all the way to the game server.
- Identify your exact model and support status. Check the product label or router administration interface, then verify firmware and security advisories through ASUS Support. The specific remediation depends on the model and current ASUS guidance.
- Update firmware and secure administration. ASUS generally advises customers to install the latest firmware and software patches. Change any factory-default administrator credentials to a strong, unique password. Review remote-management settings and disable access you do not need, following the instructions for your model.
- Review logs and indicators. The Cloud Security Alliance recommends checking device logs for known indicators of compromise (IoCs). Lumen said it planned to distribute IoCs in public feeds; availability and coverage may vary, so consult Lumen’s publication and current security advisories rather than relying on a generic checklist.
- If compromise is suspected, do not treat a restart as a fix. The reported hourly scheduled task and files under
/jffs/indicate persistence in analyzed samples, so rebooting alone should not be presented as removal. Follow current ASUS guidance for the exact model or seek help from a qualified network administrator. ASUS’s factory-reset guidance appeared in a June 4, 2025 statement concerning separate reports about CVE-2023-39780; that is not evidence that this CVE is KadNap’s entry point. ASUS security statement and updates - For an unsupported router, consider isolation or replacement. The Cloud Security Alliance advises evaluating end-of-life devices for replacement or isolation. Check whether your exact device still receives firmware updates and whether you can secure its credentials and management settings before deciding whether to keep it in service.
What Lumen’s blocking statement does—and does not—mean
As of its March 10, 2026 publication, Lumen said it had proactively blocked network traffic to or from KadNap’s control infrastructure. That describes Lumen’s own network actions; it does not establish a global takedown or confirm that all infected devices were cleaned. Lumen also said it planned to distribute IoCs in public feeds, which is not the same as confirming that every network operator has received or applied them.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What is still unknown
- The exact Asus router models affected and any KadNap-specific firmware versions.
- A confirmed vulnerability or other universal initial-access method used to infect devices.
- A universal consumer cleanup procedure that is confirmed to remove KadNap from every affected model.
For those reasons, use the report as a warning to check your own device’s support status, firmware, credentials, and logs—not as proof that every Asus router is infected or that one reset step will fix every case.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Best Value
- Blazing-fast WiFi 7 tech boosts throughput up to 7200Mbps with Multi-Link Operation and 4096-QAM.
- Bolster your wired network capacity up to 34G with one cutting-edge 10G SFP+ port and one standard 10G WAN/LAN port.
- Establish always-on internet through AI WAN detection, versatile WAN configuration options, and a convenient USB port ready for 4G LTE and 5G Mobile tethering.
- Unleash demanding WiFi 7 and 10G network applications with a powerhouse quad-core 2.6GHz 64-bit CPU.
- Easily establish up to five SSIDs with Guest Network Pro for easy IoT device setup and management, instant VPN connections, and convenient parental controls.
Rank #4
- Beyond-fast WiFi 7 (802.11be) - 320MHz channels in the 6 GHz band and 4096-QAM significantly increase network capacity and throughput, with speeds of up to 9700 Mbps
- Multi-link Operation - Link to multiple bands at the same time to ensure stable internet connections and efficient data transfers
- Versatile WAN configuration options - Establish always-on internet through AI WAN detection and a convenient USB port ready for 4G LTE and 5G Mobile tethering.
- Subscription-free Triple-Level Protection - ASUS Network Security deploys a triple-level protection design and commercial-grade cloud database, safeguarding your network from end-to-end and 24/7.
- Comprehensive VPN features - Including advanced site-to-site VPN and the Instant Guard mobile app for secure connection over public WiFi
Rank #3
- Ultrafast WiFi 7 – WiFi 7 (802.11be) dual-band extendable router boosts speed up to 6500 Mbps, with 4096-QAM increasing a single frequency band’s transmission speed by 1.2 times
- Five 2.5GbE Ports – 2.5GbE ports prioritize traffic, optimizing wired internet connectivity for maximum performance
- Hassle-free AiMesh Extendable Network – AiMesh extendable routers enable whole home seamless roaming with rich, advanced features
- Multi-link Operation – Link to multiple bands at the same time to ensure stable internet connections and efficient data transfers
- Commercial-Grade Network Security – AiProtection Pro powered by Trend Micro, plus a one-tap security scan and Safe Browsing
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
