Security researchers at SANS detected a self-replicating malware (dubbed moon worm) is spreading among a number of different Linksys routers.