Version 36: Over 9,000 Asus routers fall victim to a relentless botnet assault and a stubborn SSH backdoor immune to firmware updates

Title: Major Security Breach: Over 9,000 ASUS Routers Compromised by Botnet Attack

In a concerning development for internet security, more than 9,000 ASUS routers have fallen victim to a sophisticated botnet attack, known as “AyySSHush.” This alarming breach was uncovered in March 2025 by the cybersecurity firm GreyNoise, highlighting vulnerabilities in the authentication protocols of these devices.

The attack exploits inherent flaws in router security, taking advantage of legitimate functionalities to create a persistent SSH backdoor within the devices. What sets this incident apart is the backdoor’s placement in the router’s non-volatile memory (NVRAM). This strategic positioning ensures that, even with firmware updates or restarts, the infiltration remains intact, making traditional security measures ineffective.

As the digital landscape becomes increasingly complex, this breach underlines the critical importance of timely security updates and robust authentication mechanisms for all internet-connected devices. Users are strongly advised to secure their routers and monitor their network for any unusual activity to mitigate the risks associated with this ongoing threat.

Share this content:

One Comment

  1. Thank you for sharing this important information. The persistence of the SSH backdoor in ASUS routers, especially stored in NVRAM, poses a significant security risk that traditional firmware updates may not fully address. For affected devices, I recommend the following steps:

    • Perform a Factory Reset: A complete reset can remove some malware or hidden configurations, but be aware it may not eliminate the NVRAM-based backdoor if it is truly persistent.
    • Use Secure Authentication: Change default passwords immediately and consider disabling SSH if it is not required for remote management.
    • Implement Network Segmentation: Isolate your routers from critical devices and sensitive data to reduce potential damage.
    • Monitor Network Traffic: Keep an eye on unusual outbound connections or activity indicating possible compromise.
    • Contact ASUS Support: Since the backdoor is stored in NVRAM, which resists firmware updates, reach out to ASUS directly for guidance on specialized remediation or hardware replacement options.

    In the long term, consider deploying routers with robust security features and regularly applying firmware updates from trusted sources. Ensuring network security involves a multi-layered approach, especially against persistent threats like this.

Leave a Reply to [email protected] Cancel reply

Your email address will not be published. Required fields are marked *