Thousands of Asus routers compromised by "ViciousTrap" backdoor
- GreyNoise, a threat monitoring company, discovered in March 2025 a botnet called AyySSHush compromising over 9,000 Asus routers globally.
- The botnet exploits old authentication bypass bugs and a critical command injection flaw CVE-2023-39780 to gain persistent backdoor access.
- Attackers disable Trend Micro's AiProtection, turn off logging, enable SSH on port 53282, and add attacker-controlled keys, maintaining access across reboots and updates.
- GreyNoise noted the stealthy campaign uses official Asus features for persistence and advised users to check SSH settings and apply firmware updates promptly.
- The operation likely involves well-resourced actors, possibly nation-state linked, and suggests groundwork for a future botnet, though exact goals remain unclear.
43 Articles
43 Articles
ASUS Routers Hit by Persistent ViciousTrap Backdoor
In a chilling development for cybersecurity professionals, over 9,000 ASUS routers worldwide have been compromised by a sophisticated backdoor campaign that persists even after firmware updates and device reboots. Dubbed “ViciousTrap” by researchers, the campaign exploits known vulnerabilities and legitimate router features to maintain unauthorized access, raising alarms about the security of edge devices in homes and businesses alike. The attac…
Thousands of users around the world have their Internet connection in danger without knowing it. More than 9,000 ASUS routers have been hacked by an attacker, or group of attackers, unknown who have sneaked into them and taken control from a distance. The problem is so serious that even if you turn off the router or update it, the intruder can stay inside. The GreyNoise cybersecurity company has detected this malicious campaign, which especially…
It's not enough to update their software, you need to reset them.
Novel PumaBot slips into IoT surveillance with stealthy SSH break-ins
Security researchers are warning about a novel Linux botnet, dubbed PumaBot, targeting Internet of Things (IOT) surveillance devices. According to a DarkTrace observation, the botnet >bypasses the usual playbook of conducting internet-wide scanning and instead brute-forces secure shell (SSH) credentials for a list of targets it receives from a command and control (C2) server. “DarkTrace researchers have identified a custom Go-based Linux botnet …
Thousands of Asus routers compromised by "ViciousTrap" backdoor
Analysts at GreyNoise have uncovered a mysterious backdoor-based campaign affecting more than 9,000 Asus routers. The unknown cybercriminals are exploiting security vulnerabilities – some of which have already been patched – while others have never been assigned proper tracking entries in the CVE database. The story is full of "unknowns,"...Read Entire Article
Coverage Details
Bias Distribution
- 67% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
