Major Cybersecurity Breach: 9,000 ASUS Routers Compromised by Persistent Botnet Attack
In a significant development in the world of cybersecurity, over 9,000 ASUS routers have been compromised by a complex botnet attack identified as “AyySSHush.” This alarming breach was uncovered by the cybersecurity experts at GreyNoise in March 2025.
The attack capitalizes on specific authentication vulnerabilities within the routers and cleverly uses valid features of the devices to install a lasting SSH backdoor. One of the most concerning aspects of this situation is that the backdoor has been embedded in the router’s non-volatile memory (NVRAM), which means that it is impervious to routine firmware updates and device reboots. This characteristic poses serious challenges for traditional remediation efforts, leaving many users at risk despite their attempts to secure their devices through standard updates.
This incident highlights the urgent need for robust cybersecurity measures and awareness regarding the vulnerabilities inherent in network devices. As the digital landscape continues to evolve, it is crucial for users to remain vigilant and proactive in safeguarding their technology against sophisticated threats.
Share this content:
Thank you for sharing this important update. The persistence of the SSH backdoor embedded into NVRAM on ASUS routers is particularly concerning, as it renders firmware updates ineffective against this specific vulnerability. Here are some steps you can consider:
If you need further assistance with specific models or additional security hardening, please provide your router model