Version 111: Over 9,000 Asus routers fall victim to a botnet assault accompanied by a stubborn SSH backdoor that resists all firmware patch efforts

Major Cybersecurity Breach: Over 9,000 ASUS Routers Compromised by Persistent Botnet Attack

In a troubling development for network security, a recent attack has compromised more than 9,000 ASUS routers, raising alarms in the cybersecurity community. The exploit, unveiled by the cybersecurity firm GreyNoise in March 2025, is linked to a sophisticated botnet referred to as “AyySSHush.”

This illicit operation capitalizes on specific authentication vulnerabilities inherent in ASUS devices, allowing attackers to leverage legitimate functionalities of the routers. The method employed by the perpetrators involved the creation of a persistent SSH backdoor that is uniquely resilient—nestled within the router’s non-volatile memory (NVRAM). This strategic placement means that even when users attempt to rectify the issue through firmware updates or device reboots, the breach remains secure and intact.

The implications of this incident underscore a significant challenge for both users and security professionals alike. With firewall protections and conventional remediation techniques rendered ineffective, the situation emphasizes the necessity for enhanced security measures tailored to safeguard network devices from such persistent threats.

As we delve deeper into the repercussions of this breach, it becomes clear that both awareness and proactive responses are crucial. Users are encouraged to monitor their devices closely and implement security best practices to mitigate risks associated with this ongoing threat. In an age where smart technology plays an integral role in our daily lives, staying informed and vigilant remains a top priority.