Major Cybersecurity Breach: Over 9,000 ASUS Routers Compromised by Botnet
A recent cybersecurity breach has raised alarm bells as more than 9,000 ASUS routers have fallen victim to an advanced botnet known as “AyySSHush.” This alarming incident, identified by the cybersecurity experts at GreyNoise in March 2025, has brought to light a range of vulnerabilities in router authentication mechanisms.
The botnet attack takes advantage of these security flaws while leveraging legitimate features of the routers to create a resilient SSH backdoor. What’s particularly concerning is that this backdoor is not just a temporary exploit; it is embedded in the router’s non-volatile memory (NVRAM). This means that even after a firmware update or device reboot, the backdoor remains intact, making conventional solutions ineffective in removing the threat.
As users of affected ASUS routers navigate this pressing concern, it’s essential to stay informed about the risks associated with compromised devices and to consider steps for securing your home network. Enhanced attention to router security and prompt action may help mitigate such risks in the future.
Share this content:
Thank you for bringing attention to this critical issue. The presence of a persistent SSH backdoor embedded in affected ASUS routers, especially one stored in non-volatile memory (NVRAM), poses significant challenges for remediation through typical firmware updates. In such cases, conventional firmware re-flashing may not be sufficient to eliminate the backdoor.
As a technical support engineer, I recommend the following steps for affected users:
It’s crucial to stay informed through official outlets and act swiftly to protect your network security. If you have specific models or configurations, providing that information can help