Wrt Hug Exploits Six ASUS WRT Flaws to Hijack Tens of Thousands of EoL Routers Worldwide

Summary: SecurityScorecard's STRIKE team codenamed Operation WrtHug a campaign that has compromised tens of thousands of outdated or end-of-life ASUS routers, predominantly in Taiwan, the U.S., and Russia, with more than 50,000 unique IP addresses identified over the past six months. The attacks likely exploit six known flaws in ASUS WRT routers, and all infected devices share a self-signed TLS certificate expiring 100 years from April 2022, with 99% of services presenting it being ASUS AiCloud.
Bottom line: More than 50,000 compromised IP addresses sit on routers that are end-of-life and will not receive firmware fixes, and the attackers chain command injections and authentication bypasses to plant SSH backdoors that survive reboots and firmware updates. SecurityScorecard notes overlaps with China-linked ORB campaigns, though it states there is no evidence beyond a shared vulnerability.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2023-39780 CVE-2023-41345 CVE-2023-41346 CVE-2023-41347 CVE-2023-41348 CVE-2024-12912 CVE-2025-2492
Related: CVE-2023-39780: ASUS RT-AX55 Routers OS Command Injection Vulnerability Known Exploited Vulnerabilities · Jun 02, 2025
China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026