Version 37: Over 9,000 Asus routers exploited via botnet infiltration and an enduring SSH vulnerability unremedied by firmware updates

Major Cybersecurity Breach: Over 9,000 ASUS Routers Compromised by Persistent Botnet Attack

In a startling revelation, a significant cybersecurity breach has impacted more than 9,000 ASUS routers, with a sophisticated botnet identified as “AyySSHush” at the center of the incident. Initially uncovered by cybersecurity experts at GreyNoise in March 2025, this attack highlights alarming vulnerabilities within router authentication processes.

The AyySSHush botnet takes advantage of fundamental features inherent in routers, effectively establishing a persistent SSH backdoor. What makes this breach particularly concerning is that the backdoor is intricately integrated into the router’s non-volatile memory (NVRAM). This crucial detail means that even when users attempt to execute firmware updates or perform device reboots, the exploit remains intact, sidestepping conventional security measures.

This incident underscores the urgent need for enhanced security protocols and vigilance among consumers. As hackers continue to evolve their techniques, users must remain informed about potential threats to safeguard their networks. Regularly monitoring device settings and staying updated on cybersecurity best practices can help mitigate the risks of such persistent attacks.

In light of this discovery, it is crucial for ASUS router users to assess their current security configurations and consider additional protective measures to secure their devices against future threats.