US Edition
Thousands of Asus routers compromised by "ViciousTrap" backdoor
- GreyNoise, a threat monitoring company, discovered in March 2025 a botnet called AyySSHush compromising over 9,000 Asus routers globally.
- The botnet exploits old authentication bypass bugs and a critical command injection flaw CVE-2023-39780 to gain persistent backdoor access.
- Attackers disable Trend Micro's AiProtection, turn off logging, enable SSH on port 53282, and add attacker-controlled keys, maintaining access across reboots and updates.
- GreyNoise noted the stealthy campaign uses official Asus features for persistence and advised users to check SSH settings and apply firmware updates promptly.
- The operation likely involves well-resourced actors, possibly nation-state linked, and suggests groundwork for a future botnet, though exact goals remain unclear.
Insights by Ground AI
Does this summary seem wrong?
43 Articles
43 Articles
All
Left
Center
6
Right
3
It's not enough to update their software, you need to reset them.
·Budapest, Hungary
Read Full Article
Thousands of Asus routers compromised by "ViciousTrap" backdoor
Analysts at GreyNoise have uncovered a mysterious backdoor-based campaign affecting more than 9,000 Asus routers. The unknown cybercriminals are exploiting security vulnerabilities – some of which have already been patched – while others have never been assigned proper tracking entries in the CVE database. The story is full of "unknowns,"...Read Entire Article
Coverage Details
Total News Sources43
Leaning Left0Leaning Right3Center6Last UpdatedBias Distribution67% Center
Bias Distribution
- 67% of the sources are Center
67% Center
C 67%
R 33%
Factuality
To view factuality data please Upgrade to Premium
