Version 86: Over 9,000 Asus routers infected by a botnet assault and an enduring SSH backdoor resistant to firmware patches

Title: Major Security Breach: Thousands of ASUS Routers Compromised by Persistent Botnet

The cybersecurity landscape has been rocked by a troubling incident involving more than 9,000 ASUS routers, which have fallen victim to a sophisticated botnet attack identified as “AyySSHush.” This alarming breach was brought to light in March 2025 by the cybersecurity experts at GreyNoise, revealing a series of vulnerabilities that have been exploited by cybercriminals.

At the heart of this issue are authentication weaknesses within the router’s operating systems. Hackers are not only able to gain unauthorized access but are also leveraging legitimate router functionalities to establish a persistent Secure Shell (SSH) backdoor—a feature that remains in place even after firmware updates or device reboots. This backdoor is cleverly hidden in the router’s non-volatile memory (NVRAM), making it a formidable challenge for traditional security measures aimed at resolving such issues.

As cyber threats continue to evolve, this incident serves as a crucial reminder for users to stay vigilant about their network security. Ensuring that your router firmware is up to date is essential, but as demonstrated by this breach, it may not be enough. For ASUS router owners, it is imperative to monitor network activity closely and consider implementing additional security protocols to protect your devices from potential attacks.

This scenario underscores the importance of robust cybersecurity practices in an increasingly connected world. The ongoing threat posed by such sophisticated attacks highlights the necessity for continued vigilance and proactive measures in safeguarding digital infrastructure.