9,000 Asus routers compromised by botnet attack and persistent SSH backdoor that even firmware updates can’t fix

Title: ASUS Routers Under Siege: 9,000 Devices Compromised by a Discerning Botnet Attack

In a pressing alert for the cybersecurity community, a recent investigation has unveiled that over 9,000 ASUS routers have fallen victim to a sophisticated botnet assault identified as “AyySSHush.” The threat was revealed earlier this year, in March 2025, by the renowned cybersecurity firm, GreyNoise.

This attack takes advantage of fundamental authentication weaknesses in the routers, employing their legitimate functionalities to install a tenacious SSH backdoor. What sets this breach apart is the backdoor’s ingenious design; it is embedded within the router’s non-volatile memory (NVRAM). Consequently, this feature allows the malicious code to persist even through firmware updates and device reboots, thus thwarting standard remediation techniques that might typically be employed to clear such intrusions.

As the landscape of cybersecurity continues to evolve, this incident underscores the critical need for both manufacturers and consumers to prioritize robust security measures. Awareness and proactive action are essential in safeguarding devices against similar vulnerabilities in the future.