9,000 Asus routers compromised by botnet attack and persistent SSH backdoor that even firmware updates can’t fix

Title: Security Breach: Over 9,000 ASUS Routers Infiltrated by Persistent Botnet Attack

In a troubling cybersecurity development, more than 9,000 ASUS routers have fallen victim to a sophisticated botnet attack known as “AyySSHush.” This alarming incident, uncovered by cybersecurity experts at GreyNoise in March 2025, highlights significant vulnerabilities in the authentication protocols of these widely used devices.

The attack capitalizes on inherent router features to create a persistent SSH backdoor, which is cleverly designed to remain undetectable even after firmware updates and device restarts. This design flaw lies within the router’s non-volatile memory (NVRAM), meaning that once compromised, the backdoor can survive typical remediation attempts that would ordinarily restore the device to a secure state.

As the digital landscape continues to evolve, this incident serves as a stark reminder of the importance of maintaining robust security measures for home and office networking equipment. Users of ASUS routers should be particularly vigilant and consider implementing enhanced security practices to safeguard their devices from such threats.