{
  "Event": {
    "analysis": "2",
    "date": "2026-03-13",
    "extends_uuid": "",
    "info": "KadNap botnet IOC (mainly Asus router)",
    "publish_timestamp": "1773398322",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1773398318",
    "uuid": "2bd1fa00-6450-479c-9387-3a7fcb5e15a9",
    "Orgc": {
      "name": "CIRCL",
      "uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f"
    },
    "Tag": [
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#0071c3",
        "local": false,
        "name": "osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      },
      {
        "colour": "#0087e8",
        "local": false,
        "name": "osint:certainty=\"50\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:white",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:botnet=\"KadNap\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Payload delivery",
        "comment": "mips",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1773397234",
        "to_ids": true,
        "type": "sha256",
        "uuid": "b561aa00-9c19-4fb7-803d-a670ce554359",
        "value": "0b3dbb951de7a216dd5032d783ba7d0a5ecda2bf872643c3a4ddd1667fb38ffe"
      },
      {
        "category": "Payload delivery",
        "comment": "arm",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1773397281",
        "to_ids": true,
        "type": "sha256",
        "uuid": "d8e6536f-bd79-4b29-8071-ac67b14df17c",
        "value": "ebf9de6b67e94b2bd2b0dcda1941e04fef1a1dad830404813e468ab8744b7ed8"
      }
    ],
    "Object": [
      {
        "comment": " Kad Controlled Network Nodes as of 3/5",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "10",
        "timestamp": "1773397077",
        "uuid": "38894f87-aa53-4115-85b8-628a073c5d1f",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1773397077",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "fe57e4bb-7208-4145-ab17-6a31798b6690",
            "value": "45.135.180.38"
          },
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1773397077",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "fc2516fd-f606-4898-a00c-97d1d5150644",
            "value": "45.135.180.177"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "Report object to describe a report along with its metadata.",
        "meta-category": "misc",
        "name": "report",
        "template_uuid": "70a68471-df22-4e3f-aa1a-5a3be19f82df",
        "template_version": "8",
        "timestamp": "1773397113",
        "uuid": "18cdde47-204f-4f7b-9fe1-3197c16e1b22",
        "Attribute": [
          {
            "category": "External analysis",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "link",
            "timestamp": "1773397113",
            "to_ids": false,
            "type": "link",
            "uuid": "86c453d8-fc30-497e-b42e-714e098e3f19",
            "value": "https://raw.githubusercontent.com/blacklotuslabs/IOCs/refs/heads/main/KadNap_IOCs.txt"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "type",
            "timestamp": "1773397113",
            "to_ids": false,
            "type": "text",
            "uuid": "ef2d3f52-7c96-4f91-816c-1769d822fefe",
            "value": "Report"
          }
        ]
      },
      {
        "comment": "\u2028Previous C2s\u2028",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "10",
        "timestamp": "1773397141",
        "uuid": "406c17f2-fbeb-4982-b750-6df92857ed0f",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1773397141",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "b92c1b08-e630-403c-882a-f7fb5741b3da",
            "value": "91.193.19.51"
          },
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1773397141",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "b250082d-9849-4a89-bb17-a93a46c73e51",
            "value": "79.141.163.155"
          },
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1773397141",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "d7e3d570-a042-437c-8aa8-d22dd1393918",
            "value": "23.227.203.221"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "10",
        "timestamp": "1773397209",
        "uuid": "a9019095-6a30-4313-863c-39f76aecfbff",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1773397209",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "0e259854-5459-45d2-80b3-ffa81b7ac8d0",
            "value": "85.158.111.100"
          },
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1773397209",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "84e1d96e-b852-49f9-bb22-1ee2b998659a",
            "value": "89.46.38.74"
          },
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1773397209",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "b264b7ae-6022-43d8-8987-d8e9ac41b99c",
            "value": "154.7.253.12"
          },
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1773397209",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "b67ea4c3-12bc-4122-b420-de0858f29710",
            "value": "79.141.161.152"
          }
        ]
      },
      {
        "comment": "0b3dbb951de7a216dd5032d783ba7d0a5ecda2bf872643c3a4ddd1667fb38ffe: Enriched via the virustotal_public module",
        "deleted": false,
        "description": "VirusTotal report",
        "meta-category": "misc",
        "name": "virustotal-report",
        "template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
        "template_version": "5",
        "timestamp": "1773397251",
        "uuid": "c0192057-6b4d-42c2-be85-6e91d7185bde",
        "Attribute": [
          {
            "category": "External analysis",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "permalink",
            "timestamp": "1773397251",
            "to_ids": false,
            "type": "link",
            "uuid": "a716ac97-02ab-44f2-97d1-92b9e2696024",
            "value": "https://www.virustotal.com/gui/file/0b3dbb951de7a216dd5032d783ba7d0a5ecda2bf872643c3a4ddd1667fb38ffe"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "detection-ratio",
            "timestamp": "1773397251",
            "to_ids": false,
            "type": "text",
            "uuid": "5b4ed284-78e1-4aa8-b435-9a50496a1f2b",
            "value": "15/65"
          }
        ]
      },
      {
        "comment": "0b3dbb951de7a216dd5032d783ba7d0a5ecda2bf872643c3a4ddd1667fb38ffe: Enriched via the virustotal_public module",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1773397251",
        "uuid": "ea7b89ce-a751-46da-9eaf-3df0982ffd26",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1773397251",
            "to_ids": true,
            "type": "md5",
            "uuid": "776be6c4-0c8a-47c2-a36b-5fc11c4be384",
            "value": "5e0ab4ab2b53e8e1dbb74dd97c03979d"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1773397251",
            "to_ids": true,
            "type": "sha1",
            "uuid": "342ec24a-a5ae-47fe-9f7a-0051af407b72",
            "value": "b81e1dcd55e9b6b169d52ee72dc061f90c123515"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1773397251",
            "to_ids": true,
            "type": "sha256",
            "uuid": "a5eb5784-3bfc-43b9-b756-54b31162d872",
            "value": "0b3dbb951de7a216dd5032d783ba7d0a5ecda2bf872643c3a4ddd1667fb38ffe"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "tlsh",
            "timestamp": "1773397251",
            "to_ids": true,
            "type": "tlsh",
            "uuid": "03148ab8-eeb4-448e-99f8-5d0abdcebd47",
            "value": "t195644c07ff94aed7c857cd320878c753148ce59b5298213e31f8ca4dff6a60a4a578a9"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1773397251",
            "to_ids": true,
            "type": "vhash",
            "uuid": "052f3917-b45c-4943-bfb6-f444f1351f81",
            "value": "dc7e4b158cee8ed39dd2bf6e86fca227"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1773397251",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "9c51001a-e7ee-409d-bebf-87e03788d0cc",
            "value": "6144:yDRe/kAR9jEeTTN8R15u9f/c+RZK4V3mD2RrD8gQmDjixe5xzjYF0XWj0fJd2XRW:yDRe/kAR9jEeTTN8R15u9f/c+RZV3mD/"
          }
        ]
      },
      {
        "comment": "ebf9de6b67e94b2bd2b0dcda1941e04fef1a1dad830404813e468ab8744b7ed8: Enriched via the virustotal_public module",
        "deleted": false,
        "description": "VirusTotal report",
        "meta-category": "misc",
        "name": "virustotal-report",
        "template_uuid": "d7dd0154-e04f-4c34-a2fb-79f3a3a52aa4",
        "template_version": "5",
        "timestamp": "1773397395",
        "uuid": "3efe660c-26e5-413e-8450-ecdb885b0196",
        "Attribute": [
          {
            "category": "External analysis",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "permalink",
            "timestamp": "1773397395",
            "to_ids": false,
            "type": "link",
            "uuid": "849755d3-6813-4b23-97c9-0c1ff2d4871b",
            "value": "https://www.virustotal.com/gui/file/ebf9de6b67e94b2bd2b0dcda1941e04fef1a1dad830404813e468ab8744b7ed8"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "detection-ratio",
            "timestamp": "1773397395",
            "to_ids": false,
            "type": "text",
            "uuid": "a739ccdb-3775-45e5-b958-af3c44f552bb",
            "value": "19/65"
          }
        ]
      },
      {
        "comment": "ebf9de6b67e94b2bd2b0dcda1941e04fef1a1dad830404813e468ab8744b7ed8: Enriched via the virustotal_public module",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1773397395",
        "uuid": "0e48bd10-f58d-4aef-8746-f59feb756249",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1773397395",
            "to_ids": true,
            "type": "md5",
            "uuid": "0b0782a4-bdb5-4cc6-9e64-26044955bfe6",
            "value": "103710ebc767772eb0e033e0bb6c77da"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1773397395",
            "to_ids": true,
            "type": "sha1",
            "uuid": "cfd706bc-acac-44f7-a594-54a1f023ae7c",
            "value": "82d62c92d1e5d2e4b4571401b8dbd225d9216a0e"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1773397395",
            "to_ids": true,
            "type": "sha256",
            "uuid": "70a9bc56-f01c-4b7c-8482-1f9571b01809",
            "value": "ebf9de6b67e94b2bd2b0dcda1941e04fef1a1dad830404813e468ab8744b7ed8"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "tlsh",
            "timestamp": "1773397395",
            "to_ids": true,
            "type": "tlsh",
            "uuid": "8b77dd11-dfbd-43eb-8d25-f9bde29b0a36",
            "value": "t1d03408a1f8909e82c6906abffb1e828d330357bcd3ee31069e145b7427d7d594e3a941"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1773397395",
            "to_ids": true,
            "type": "vhash",
            "uuid": "d06ba137-ac09-487e-b303-849dc75dd725",
            "value": "76becfa7727549d2bfb044bb67a602cb"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1773397395",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "11c6d477-62c5-4e0e-920a-b5ee7f616fd3",
            "value": "3072:DafTo5xJB61i+NODxTpSDMVrg88x2XxkncamNAHwEFjeAQ8kOWxtWGGaxXsWC/zi:iP1irxT3z80xknC6eAQ+LalC7UP"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "Report object to describe a report along with its metadata.",
        "meta-category": "misc",
        "name": "report",
        "template_uuid": "70a68471-df22-4e3f-aa1a-5a3be19f82df",
        "template_version": "8",
        "timestamp": "1773397832",
        "uuid": "36204761-4b63-420f-98a7-78b43d8cd0e5",
        "Attribute": [
          {
            "category": "External analysis",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "link",
            "timestamp": "1773397832",
            "to_ids": false,
            "type": "link",
            "uuid": "1a06ad5f-ee30-4307-b1c1-18d5fa66e648",
            "value": "https://blog.lumen.com/silence-of-the-hops-the-kadnap-botnet/"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "summary",
            "timestamp": "1773397832",
            "to_ids": false,
            "type": "text",
            "uuid": "cd57c178-78dc-419d-926c-00bc62cf9bc0",
            "value": "The Black Lotus Labs team at Lumen has discovered a sophisticated new malware named \u201cKadNap.\u201d This threat primarily targets Asus routers, conscripting them into a botnet that proxies malicious traffic. Since August 2025, we have been monitoring the growth of this network, which is now above 14,000 infected devices.\r\n\r\nKadNap employs a custom version of the Kademlia Distributed Hash Table (DHT) protocol, which is used to conceal the IP address of their infrastructure within a peer-to-peer system to evade traditional network monitoring. Infected devices use the DHT protocol to locate and connect with a command-and-control (C2) server, while defenders cannot easily find and add those C2s to threat lists. In short, the innovative use of the DHT protocol allows the malware to establish robust communication channels that are difficult to disrupt by hiding in the noise of legitimate peer-to-peer traffic.\r\n\r\nOnce added to the network, bots are then marketed by a proxy service called \u201cDoppelganger,\u201d which is specifically tailored for criminal activity and appears to be a rebrand of the Faceless service, which was powered by victims of TheMoon malware.\r\n\r\nUsing the expansive Lumen global backbone to observe KadNap\u2019s infrastructure, we found that more than 60% of KadNap\u2019s victims are based in the United States. While Asus routers are the primary targets, the operators are using the malware effectively against a variety of edge networking devices and set aside a number of C2s used to silo their infrastructure by victim type.\r\n\r\nAs of this publication, Lumen has proactively blocked all network traffic to or from the control infrastructure. Given the obfuscation of C2 servers inherent to this protocol, Black Lotus Labs will share the indicators of compromise (IoCs) and will begin distributing the indicators of compromise (IoCs) into public feeds to enable others to help disrupt this threat.\r\n\r\nLumen Technologies would like to thank our partners at Spur for their contributions to our efforts to track and mitigate this threat."
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "type",
            "timestamp": "1773397832",
            "to_ids": false,
            "type": "text",
            "uuid": "1579608e-783d-4aed-8495-2d27f6cd2973",
            "value": "Report"
          }
        ]
      }
    ]
  }
}