ASUS router backdoors affect 9K devices

Here’s a summary of the recent ASUS router security incident, based on the latest reports:

🔍 1. Incident Overview

• Scope: Approximately 9,000 ASUS Wi-Fi 6 routers (primarily RT-AX55 models) have been compromised by a botnet dubbed “AyySSHush” .
• Persistence: The backdoor survives firmware updates, reboots, and factory resets because it is stored in the router’s non-volatile memory (NVRAM) .
• Detection: Cybersecurity firm GreyNoise identified the campaign in March 2025, though attacks were extremely stealthy (only 30 malicious requests detected over three months) .

---

⚙️ 2. How the Attack Works

• Initial Access: Attackers use brute-force logins, authentication bypass exploits (some unpatched), and a known command injection vulnerability (CVE-2023-39780) to gain control .
• Backdoor Setup: Once accessed, attackers:
  • Enable SSH on a custom port (TCP/53282).
  • Add their public SSH key to the router’s authorized_keys file for persistent remote access.
  • Disable logging and security features (e.g., AiProtection) to evade detection .
• No Malware: The attack abuses legitimate ASUS router features, leaving no traditional malware traces .

---

❗ 3. Why Firmware Updates Fail to Remove the Backdoor

• The backdoor is written to NVRAM, which retains configuration data even during firmware upgrades or resets.
• ASUS patched CVE-2023-39780 in recent firmware, but this only prevents new attacks. Existing compromises persist.

---

🛡️ 4. Recommended Mitigation Steps

If you own an ASUS router (especially RT-AX55):
1️⃣ Update Firmware: Install the latest patch from ASUS to fix known vulnerabilities .
2️⃣ Check for Compromise:

• Scan for open SSH port 53282.
• Review the authorized_keys file for unrecognized entries .
  3️⃣ Full Factory Reset: Required to purge the NVRAM backdoor. After reset, manually reconfigure the router .
  4️⃣ Disable Remote SSH: Unless essential, disable WAN-facing SSH access in router settings .
  5️⃣ Block Malicious IPs: Use firewall rules to block IPs linked to the campaign (identified by GreyNoise) .

Infection Statistics 

Metric	Detail
Confirmed Compromised	~9,000 routers (as of May 27)
Primary Targets	Taiwan, U.S.
Botnet Name	AyySSHush

---

🌐 5. Attribution & Motive

• Suspected actor “ViciousTrap” (potentially China-linked) due to targeting patterns avoiding Chinese devices .
• Goal: Likely building a botnet for future attacks (e.g., DDoS, proxy networks) .

💎 Key Insight

This attack highlights critical risks in router security: Even patched devices remain vulnerable if compromised before updates. Proactive checks and resets are essential—not just firmware updates.

From：
https://www.probatteryer.com/
https://www.probatteryer.com/blog/
https://www.batteryer.uk/blog
https://www.batteryer.sg/blog
https://www.batteryer.nz/blog/