KadNap Malware Infects 14,000+ Edge Devices to Power Stealth Proxy Botnet

This article covers KadNap, a new malware targeting edge devices to build a stealth proxy botnet, and ClipXDaemon, a Linux clipboard hijacker targeting cryptocurrency users.

• •KadNap uses a custom Kademlia DHT protocol to hide C2 infrastructure within peer-to-peer traffic, making it difficult to detect or disrupt
• •Over 14,000 devices are infected, primarily Asus routers, with 60%+ of victims in the U.S.; ARM and MIPS processors are both targeted
• •Infected devices are marketed through a proxy service called Doppelgänger, assessed to be a rebrand of the Faceless proxy service linked to TheMoon malware
• •KadNap establishes persistence via a cron job, closes SSH port 22, and segments C2 communication by device type and model
• •ClipXDaemon is a memory-resident Linux clipper malware that monitors the clipboard every 200ms and replaces cryptocurrency wallet addresses with attacker-controlled ones, targeting X11 environments while avoiding Wayland sessions