Noise Letter May 2025

Summary: GreyNoise reports a stealthy backdoor campaign affecting thousands of ASUS routers, in which attackers gained persistent access that survived reboots and firmware updates by abusing legitimate configuration features, first observed March 18, 2025. The same month, its sensors recorded a coordinated scan blitz hitting 75 exposure points in a single day.
Why it matters: The ASUS backdoor persisted through reboots and firmware updates by using the router's own legitimate configuration features, so the usual fix of patching and restarting does not clear it across thousands of affected devices.

Read the original at GreyNoise Blog ↗