9,000 Asus routers compromised by botnet attack and persistent SSH backdoor that even firmware updates can’t fix

Major Cybersecurity Breach: Over 9,000 ASUS Routers Compromised by Persistent Botnet Attack

In a troubling development for network security, a sophisticated cyberattack has compromised more than 9,000 ASUS routers through a malicious botnet identified as “AyySSHush.” This alarming revelation surfaced in March 2025, thanks to investigations by the cybersecurity firm GreyNoise.

The attack takes advantage of certain vulnerabilities in the router’s authentication processes, leveraging legitimate functions to covertly install a persistent SSH backdoor. What sets this breach apart is the backdoor’s placement in the router’s non-volatile memory (NVRAM). This strategic positioning allows it to survive not only routine device reboots but also firmware updates, leaving conventional methods of remediation futile.

As the digital landscape evolves, it increasingly becomes clear that maintaining robust security measures for connected devices is paramount. For users of ASUS routers, immediate action is recommended to mitigate potential vulnerabilities and protect sensitive networked environments. Stay informed and proactive in your cybersecurity efforts to safeguard against such sophisticated attacks.