Major Cybersecurity Breach: Over 9,000 ASUS Routers Compromised by Advanced Botnet
In a troubling cybersecurity development, a recent attack has compromised more than 9,000 ASUS routers, raising concerns about the safety and integrity of home and business networks. The incident came to light in March 2025, thanks to the diligent efforts of cybersecurity firm GreyNoise, which uncovered the exploit affecting these widely used network devices.
The sophisticated botnet, referred to as “AyySSHush,” takes advantage of authentication vulnerabilities within the routers. Once these weaknesses are exploited, the attackers leverage legitimate features already present in the routers to implant a persistent SSH backdoor. What sets this breach apart is that the backdoor is tucked away in the router’s non-volatile memory (NVRAM), allowing it to resist typical fixes such as firmware updates and device reboots. This means that even attempts to update the router’s software may not eliminate the threat, effectively keeping the compromised device vulnerable.
As the implications of this breach unfold, it serves as a crucial reminder for users to remain vigilant and proactive about network security. Regularly changing passwords, disabling remote access if not needed, and staying informed about the latest security updates can help mitigate risks associated with such sophisticated threats.
In light of these developments, it is essential for ASUS router users to assess their devices for any signs of compromise and to consult official security resources to safeguard their networks against similar attacks in the future.
Share this content:
Thank you for sharing this important update. The persistence of the SSH backdoor in ASUS routers despite firmware updates highlights a concerning security challenge. For affected devices, I recommend performing a full factory reset to attempt to remove persistent malware, but bear in mind the backdoor stored in NVRAM may still persist. To enhance your network security, consider the following steps:
Additionally, deploying network segmentation and VPN solutions can help contain potential breaches and safeguard sensitive data. If you suspect your device has been compromised, consider consulting with cybersecurity professionals for a thorough assessment and remediation plan.