US EditionThousands of Asus Routers Are Being Hit with Stealthy, Persistent Backdoors
- GreyNoise discovered in mid-March 2025 that thousands of Asus routers worldwide are compromised by a botnet called AyySSHush that operates covertly.
- The compromise occurred through brute-force login attempts and exploitation of an older command injection flaw, CVE-2023-39780, allowing persistent backdoor access.
- Attackers used system commands to add SSH keys, enable SSH on port 53282, and disable Trend Micro’s AiProtection and logging to evade detection on models like RT-AC3100 and RT-AX55.
- GreyNoise reported over 9,000 infected hosts, noting persistence across firmware updates and describing the adversary as advanced and well-resourced, while Asus has issued patches addressing the vulnerabilities.
- The botnet’s exact purpose remains unclear, but users are advised to upgrade firmware, check for unauthorized SSH keys, and perform factory resets if compromised to remove persistent backdoors.
Insights by Ground AI
Does this summary seem wrong?
20 Articles
20 Articles
All
Left
Center
5
Right
Thousands of Asus routers compromised by "ViciousTrap" backdoor
Analysts at GreyNoise have uncovered a mysterious backdoor-based campaign affecting more than 9,000 Asus routers. The unknown cybercriminals are exploiting security vulnerabilities – some of which have already been patched – while others have never been assigned proper tracking entries in the CVE database. The story is full of "unknowns,"...Read Entire Article
Coverage Details
Total News Sources20
Leaning Left0Leaning Right0Center5Last UpdatedBias Distribution100% Center
Bias Distribution
- 100% of the sources are Center
100% Center
C 100%
Factuality
To view factuality data please Upgrade to Premium
Ownership
To view ownership data please Upgrade to Vantage
