This is a historical account of the Pink botnet research published by 360 Netlab on 29 October 2021. Its infection figures describe the researchers’ earlier observations, not a measurement of devices infected today.
What the research reported
Netlab reported a peak exceeding 1.6 million infected devices, mainly fibre routers using MIPS processors and largely located in China. The researchers described Pink as the largest botnet they had directly observed in six years, rather than establishing that it was the largest botnet ever discovered worldwide.
The report described a hybrid command-and-control architecture using peer-to-peer communication, central servers and third-party services. The operators attempted to retain control while the device vendor worked to recover affected routers. At publication, Netlab said most affected devices had been dealt with.
How to use this case today
The case illustrates why connected-device inventories, supported firmware and a recovery process matter. It does not establish that a current router is infected because it shares a processor type or because a historical infection count was large.
For a device you operate, check the exact model and vendor advisories, apply supported firmware, change default credentials and restrict unnecessary remote administration. Investigate suspicious behaviour with evidence specific to that device. These steps reduce risk without guaranteeing that every compromise can be detected.
Primary source: 360 Netlab’s Pink report, 29 October 2021. Historical context reviewed: 30 October 2026.
