Grey Noise Discovers Stealthy Backdoor Campaign Affecting Thousands of ASUS Routers
Summary: GreyNoise discovered on March 18, 2025 an ongoing campaign in which attackers gained persistent access to thousands of internet-exposed ASUS routers, with access surviving reboots and firmware updates. The attackers chained authentication bypasses, a known vulnerability, and legitimate configuration features to avoid dropping malware, and Sift flagged just three HTTP POST requests on emulated ASUS router profiles to surface the activity.
What's compelling: The backdoor persists through reboots and firmware updates, so a router compromised before patching stays compromised unless SSH access is explicitly reviewed and removed - and GreyNoise attributes the tradecraft to a well-resourced adversary without naming one.
Read the original at GreyNoise Blog ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026