# AVrecon malware

**URL:** <https://forum.gl-inet.com/t/avrecon-malware/31374>\
**Category:** Router\
**Created:** [July 14, 2023, 2:05pm UTC](https://forum.gl-inet.com/t/avrecon-malware/31374 "2023-07-14T14:05:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![morcheba](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/morcheba/32/5295_2.png) [@morcheba](https://forum.gl-inet.com/u/morcheba)\
**Post date:** [July 14, 2023, 2:05pm UTC](https://forum.gl-inet.com/t/avrecon-malware/31374/1 "2023-07-14T14:05:11Z")

</div>

Hello

Are GliNet devices protected against AVrecon malware infection?

> **[AVrecon malware infects 70,000 Linux routers to build botnet](https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/avrecon-malware-infects-70-000-linux-routers-to-build-botnet/amp/)**
>
> Since at least May 2021, stealthy Linux malware called AVrecon was used to infect over 70,000 Linux-based small office/home office (SOHO) routers to a botnet designed to steal bandwidth and provide a hidden residential proxy service.

---

<div class="post-metadata">

**Author:** ![bring.fringe18](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/bring.fringe18/32/11777_2.png) [@bring.fringe18](https://forum.gl-inet.com/u/bring.fringe18)\
**Post date:** [July 14, 2023, 2:22pm UTC](https://forum.gl-inet.com/t/avrecon-malware/31374/2 "2023-07-14T14:22:13Z")

</div>

If the GL device in question runs OpenWrt Linux ‘under the hood’ (most if not all the home/travel user models do; IoT gear may not) then any security advisories would be related to that firmware/operating system rather than something proprietary like Netgear’s.

It can help to change your DNS provider/upstream to mitigate such threats as they’re found.

 ![2023-07-14 10_20_55-GL-AXT1800 - Overview - LuCI - Chromium](https://forum-static.gl-inet.com/original/2X/e/e96c535b21a5361aa532cb7e471739fb8987b568.png)

> **[OpenWrt Security Advisories](https://openwrt.org/advisory/start)**
>
> OpenWrt Security Advisories \* Security Advisory 2022-10-17-1 - Multiple issues in mac80211 and cfg80211 (CVE-2022-41674, CVE-2022-42719, CVE-2022-42720, CVE-2022-42721 and CVE-2022-42722) \* Security Advisory 2022-10-04-1 - wolfSSL buffer overflow...

> **[Quad9 | A public and free DNS service for a better security and privacy](https://www.quad9.net/)**
>
> A public and free DNS service for a better security and privacy

---

<div class="post-metadata">

**Author:** ![bruce](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/bruce/32/35649_2.png) [@bruce](https://forum.gl-inet.com/u/bruce)\
**Post date:** [October 29, 2025, 4:23am UTC](https://forum.gl-inet.com/t/avrecon-malware/31374/3 "2025-10-29T04:23:03Z")

</div>