Version 99: Over 9,000 Asus routers fall prey to a botnet assault and a stubborn SSH backdoor that withstands all firmware updates

A Serious Cybersecurity Threat: Over 9,000 ASUS Routers Compromised

In a startling discovery, the cybersecurity firm GreyNoise has unveiled a significant breach impacting more than 9,000 ASUS routers. This incident revolves around a sophisticated botnet identified as “AyySSHush,” which takes advantage of vulnerabilities in router authentication protocols.

The issue first came to light in March 2025. This attack utilizes legitimate features of the router infrastructure to create a persistent SSH backdoor. What makes this situation particularly alarming is that the backdoor is embedded within the router’s non-volatile memory (NVRAM). As a result, it remains intact even after firmware updates or device reboots, effectively circumventing traditional attempts at remediation.

The implications of this breach are profound, highlighting serious risks for both individual users and larger networks. While software patches and firmware updates are critical for maintaining device security, the presence of a signature backdoor like this one makes even those measures futile. This incident underscores the importance of vigilance in network management and the need for advanced security practices to protect against evolving threats.

Given the complexities of modern cybersecurity, users are urged to take proactive measures, such as changing default passwords, disabling unnecessary services, and monitoring network activity for suspicious behavior. Staying informed and prepared is the best defense against such formidable threats in today’s interconnected landscape.