Major Security Breach: Over 9,000 ASUS Routers Compromised by Botnet Attack
In a troubling development for cybersecurity, a concerning breach affecting more than 9,000 ASUS routers has come to light. Discovered in March 2025 by the cybersecurity experts at GreyNoise, this incident revolves around a sophisticated botnet called “AyySSHush.”
The attack takes advantage of vulnerabilities in the device’s authentication system, leveraging standard router functionalities to create a persistent SSH backdoor. What sets this attack apart is the backdoor’s secure placement in the router’s non-volatile memory (NVRAM). This strategic positioning allows it to remain intact even after firmware updates or device restarts, thus complicating conventional recovery efforts.
The implications of this breach are significant, as it highlights the critical need for robust cybersecurity measures in our increasingly connected world. Users of affected ASUS routers should be on high alert and take immediate steps to secure their network configurations to mitigate potential risks. It’s a stark reminder that even trusted devices can harbor hidden vulnerabilities—an essential lesson for both consumers and manufacturers alike.
Share this content:
Thank you for bringing this critical issue to attention. Unfortunately, as these backdoors are stored in the router’s NVRAM, they can persist through standard firmware updates, making them particularly challenging to remove. Here are some recommended steps to try and mitigate the threat: