Major Cybersecurity Breach: Over 9,000 ASUS Routers Compromised by Sophisticated Botnet
In a troubling revelation, more than 9,000 ASUS routers have fallen victim to a complex cyberattack identified by the cybersecurity firm GreyNoise. This incident, which came to light in March 2025, has been attributed to a botnet known as “AyySSHush.”
The attack leverages existing vulnerabilities in router authentication protocols and takes advantage of legitimate features within the router’s framework. What sets this breach apart is the establishment of a persistent SSH backdoor, which poses a significant risk to users. This backdoor is cunningly embedded in the router’s non-volatile memory (NVRAM). As a result, it remains intact even through firmware updates and device reboots, making conventional methods of remediation ineffective.
For users relying on these affected devices, the implications are severe. Traditional cybersecurity safeguards typically rely on the assumption that firmware updates can restore security levels by removing threats; however, in this case, the exploit’s resilience undermines such measures.
It is crucial for ASUS router owners to take immediate action by evaluating their security settings and considering more robust protection strategies. Staying informed about the evolving landscape of cyber threats can help mitigate risks associated with these types of attacks.
Share this content:
Thank you for bringing this critical issue to attention. The persistence of the SSH backdoor embedded in the ASUS routers’ NVRAM is indeed concerning, as it evades typical firmware updates. To mitigate this threat, I recommend the following steps: