Top all-time · #8142
奇安信 X 实验室
Company blog · blog.xlab.qianxin.comsecurity
奇安信 X 实验室 is the company blog at blog.xlab.qianxin.com, writing about security. Since 2024, 10 different Hacker News readers have linked it 10 times, most often “Kimwolf Exposed: The Android Botnet with 1.8M Infected Devices”. It is still writing: the last post was on 2026-07-29, and you can follow it by feed.
Too few sampled comments (3) to say how often HN recommends it.?
Why HN links it
Qianxin X Lab's threat research blog, cited on HN as the original technical analysis of botnets such as Kimwolf, Gayfemboy and AryStinger, including their size, evasion methods and CVEs.
Summarised by Claude from a sample of 3 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Kimwolf Exposed: The Android Botnet with 1.8M Infected Devices2 people · 2 mentions · first linked 2025-12-23
- Gayfemboy: A Botnet Deliver Through a Four-Faith Industrial Router 0-Day Exploit2 people · 2 mentions · first linked 2025-01-08
What Hacker News says?
I couldn't really follow the technical details of the malware from the article, so I found what seems to be the first major report on the topic: https://blog.xlab.qianxin.com/kimwolf-botnet-en/#network-pro... That article has a more technical lens. It focuses primarily on the size and detection evasion methods of Kimwolf, rather than some notable (and definitely not unique) method of spreading. Without looking too d…
Comment linking /kimwolf-botnet-en/
on “The Kimwolf Botnet Is Stalking Your Local Network”Submitted Kimwolf Exposed: The Android Botnet with 1.8M Infected Devices as a story · 6 points
HN discussionThis forbes article is lacking in details; here's the OG threat analysis report: https://blog.xlab.qianxin.com/gayfemboy-en/
Comment linking /gayfemboy-en/
on “Gayfemboy 0-Day Router Attacks Ongoing–What You Need to Know”Submitted Gayfemboy: A Botnet Deliver Through a Four-Faith Industrial Router 0-Day Exploit as a story · 6 points
HN discussion>AryStinger exploits older flaws such as CVE-2013-3307, CVE-2016-5681, and CVE-2025-11837, targeting primarily D-Link DIR-850L, D-Link DIR-818LW routers. https://nvd.nist.gov/vuln/detail/CVE-2013-3307 https://nvd.nist.gov/vuln/detail/CVE-2016-5681 https://nvd.nist.gov/vuln/detail/CVE-2025-11837 Original source: https://blog.xlab.qianxin.com/arystinger-botnet-hijacks-lega...
Comment linking /arystinger-botnet-hijacks-legacy-routers-for-global-attacks-en/
on “AryStinger botnet infected D-Link routers worldwide”Submitted A Brief Overview of the DDoS Attack on the Trump-Musk Livestream as a story · 6 points
HN discussionSubmitted Bigpanzi Exposed: The Hidden Cyber Threat Behind Your Set-Top Box (2024) as a story · 2 points
HN discussionSubmitted RustDuck: An In-Depth Analysis of a Two-Stage Botnet as a story · 1 points
HN discussionSubmitted Kimwolf Exposed: The Android Botnet with 1.8M Infected Devices as a story · 1 points
HN discussionSubmitted Long Live the Vo1d Botnet: New Variant Hits 1.6M TV Globally as a story · 1 points
HN discussion