Asus Wi-Fi Routers Targeted in Stealthy Cyberattack Campaign

A recent cybersecurity alert from GreyNoise reveals that over 9,000 Asus Wi-Fi routers have been compromised in an ongoing, stealthy exploitation campaign. Since March 17, attackers have maintained persistent backdoor access to these devices, even surviving reboots and firmware updates. This durability makes the threat particularly concerning for network security.

Interestingly, the attackers are not targeting personal data directly. Instead, they leverage the computational power of infected routers to build botnets capable of launching large-scale denial-of-service (DDoS) attacks. This tactic echoes the infamous 2016 Mirai botnet attack, which disrupted major websites like Twitter and Netflix.

GreyNoise has observed that the attack is conducted with a high level of sophistication, suggesting a well-resourced adversary. While the exact origin remains unclear, government agencies have previously linked similar attacks to nation-state actors such as China, Russia, North Korea, and Iran.

The vulnerability exploited allows attackers to add a persistent SSH backdoor that remains even after firmware updates. This backdoor uses SSH over port 53282 with a specific truncated public key, enabling unauthorized remote access that typical security measures cannot easily remove.

For Asus router owners, detecting compromise involves logging into the router’s firmware interface and checking the SSH settings. If unauthorized SSH access is enabled with the known malicious key, the router is infected. Simply updating the firmware won’t remove the backdoor.

To secure an infected router, users must:

• Disable SSH access in the router’s Service or Administration settings.
• Block the following IP addresses known to be used by attackers: 101.99.91.151, 101.99.94.173, 79.141.163.179, and 111.90.146.237.
• Restore the router to factory settings to remove any unauthorized configurations.
• Update to the latest firmware version released by Asus to patch the vulnerability.

This attack highlights the evolving complexity of IoT and network device security. It’s a reminder that even trusted manufacturers can face persistent threats requiring proactive, technical responses. Staying informed and vigilant is essential to protect your network from becoming a silent participant in cyberattacks.