Major Security Breach: Over 9,000 ASUS Routers Compromised by Persistent Botnet

In a troubling development for network security, a recent attack has compromised more than 9,000 ASUS routers through a complex botnet known as “AyySSHush.” This alarming breach was uncovered in March 2025 by cybersecurity specialists at GreyNoise, who identified the exploitation of authentication weaknesses in the routers.

The botnet takes advantage of legitimate features within the routers to install a persistent SSH backdoor, a method that significantly complicates any attempts to regain control of the affected devices. What exacerbates the situation is that this backdoor has been cleverly integrated into the router’s non-volatile memory (NVRAM). As a result, even firmware updates and device reboots fail to eliminate this vulnerability, as it remains intact regardless of traditional remediation efforts.

This incident highlights the critical need for improved security measures and prompts users to regularly review their router configurations and firmware for potential vulnerabilities. Given the evolving nature of cyber threats, it is essential now more than ever to stay informed and proactive in safeguarding home and office networks from such attacks.

For those using ASUS routers, vigilance is key. It is highly recommended to monitor any unusual network activity and to keep an eye out for updates from ASUS addressing this serious issue. Advances in security practices and awareness can significantly mitigate risks in the continuously evolving landscape of cybersecurity.