Pierluigi Paganini
May 29, 2025
GreyNoise discovered the AyySSHush botnet has hacked over 9,000 ASUS routers, adding a persistent SSH backdoor.
“Using an AI powered network traffic analysis tool we built called SIFT, GreyNoise has caught multiple anomalous network payloads with zero-effort that are attempting to disable TrendMicro security features in ASUS routers, then exploit vulnerabilities and novel tradecraft in ASUS AiProtection features on those routers.” states GreyNoise.
The threat intelligence firm uncovered a stealth campaign on March 18, 2025, where attackers gained persistent access to thousands of internet-exposed ASUS routers. Using subtle tactics, like auth bypasses and abuse of legit settings, the attackers avoid detection while keeping control, even after reboots or updates. Though attribution remains unclear, the campaign shows signs of a skilled, well-funded adversary building a covert botnet infrastructure.
“GreyNoise has identified an ongoing exploitation campaign in which attackers have gained unauthorized, persistent access to thousands of ASUS routers exposed to the internet.” reads the report published by GreyNoise. “The attacker’s access survives both reboots and firmware updates, giving them durable control over affected devices.”
The payloads observed by the experts only target ASUS RT-AC3100 or RT-AC3200 with an Out-Of-Box configuration.
GreyNoise also found a payload exploiting the authenticated command injection flaw CVE-2023-39780 in ASUS RT-AX55 v3.0.0.4.386.51598 to execute arbitrary system commands.
The attackers exploit the command injection flaw to add their SSH key and enable access on port 53282, ensuring persistent backdoor access across reboots and updates.
“This payload leverages built-in ASUS router features to enable SSH on both LAN and WAN, bind it to TCP/53282, and add an attacker-controlled public key.” reads the full technical analysis published by GreyNoise. “Because this key is added using the official ASUS features, this config change is persisted across firmware upgrades. If you’ve been exploited previously, upgrading your firmware will NOT remove the SSH backdoor.”
As of May 27, nearly 9,000 ASUS routers are confirmed compromised, based on Censys data. Despite the scale, only 30 related requests were observed over three months, highlighting how stealthy the campaign is.
GreyNoise published a list of four IP addresses associated with the botnet’s campaign as Indicators of Compromise.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, AyySSHush botnet)
