One Comment

1. Thank you for sharing this critical update. The persistence of the AyySSHush botnet and its ability to embed itself within the router’s non-volatile memory (NVRAM) indeed pose a serious challenge for traditional firmware-based remediation methods. In such cases, standard firmware updates may not be sufficient to remove the backdoor.

   To mitigate this threat, I recommend the following steps:

   • Factory Reset: Perform a comprehensive factory reset of the affected ASUS routers. This can sometimes clear malicious configurations, but be aware that if the malware resides in NVRAM, it may still persist after reset.
   • Reflashing Firmware: If possible, try to reflash the firmware with a clean, verified image directly from ASUS. Using a TFTP or serial connection to load firmware in the low-level recovery mode might be more effective than standard firmware updates.
   • Advanced Cleaning: Given the persistence of the backdoor, consider using specialized security tools or contacting ASUS support for guidance on advanced cleaning procedures or hardware replacement options.
   • Network Monitoring and Segmentation: Isolate affected devices on their own network segment and implement strict access controls to prevent further compromise or lateral movement.
   • Security Best Practices: Regularly change default credentials, disable unnecessary services, and monitor outbound traffic for suspicious activity to reduce the risk of

   Reply