InfoSecBulletin Cybersecurity for mankind
GreyNoise has discovered a campaign where attackers have gained unauthorized access to thousands of internet-exposed ASUS routers. This seems to be part of a covert effort to create a network of backdoor devices, possibly aiming to establish a botnet in the future.
The tactics in this campaign—sneaky initial access, using built-in system features to stay persistent, and avoiding detection—are similar to those used by advanced persistent threat (APT) actors and operational relay box (ORB) networks. GreyNoise hasn’t attributed this activity, but the sophistication indicates a well-resourced and skilled adversary.
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
The attacker retains control over affected devices even after reboots and firmware updates. They achieve long-term access without installing malware or leaving clear evidence by using authentication bypasses, exploiting a known vulnerability, and misusing legitimate configuration features.
Sift, GreyNoise’s AI analysis tool, along with emulated ASUS router profiles in the GreyNoise Global Observation Grid, helped us identify subtle exploitation attempts in global traffic and piece together the entire attack sequence.
Summary of Findings:
Thousands of ASUS routers are confirmed compromised, with the number steadily increasing.
Attackers gain access using brute-force login attempts and authentication bypasses, including techniques not assigned CVEs.
Attackers exploit CVE-2023-39780, a command injection flaw, to execute system commands.
They use legitimate ASUS features to:
Enable SSH access on a custom port (TCP/53282).
Insert attacker-controlled public key for remote access.
The backdoor is stored in non-volatile memory (NVRAM) and is therefore not removed during firmware upgrades or reboots.
No malware is installed, and router logging is disabled to evade detection.
The techniques used reflect long-term access planning and a high level of system knowledge.
Confirmed Exploitation Chain:
Initial Access
Brute-force login attempts.
Two authentication bypass techniques (no CVEs assigned).
Command Execution
Exploitation of CVE-2023-39780 to run arbitrary commands.
Persistence
SSH access is enabled via official ASUS settings.
Attacker inserts a custom public SSH key.
Configuration is stored in NVRAM, not on disk.
Stealth
Logging is disabled before persistence is established.
No malware is left behind.
Indicators of Compromise:
IP addresses involved in this activity:
101.99.91.151
101.99.94.173
79.141.163.179
111.90.146.237
ASUS patched CVE-2023-39780 in a recent firmware update.
If a router was compromised before updating, the backdoor will still be present unless SSH access is explicitly reviewed and removed.
Recommendations:
Check ASUS routers for SSH access on TCP/53282. Review the authorized_keys file for any unauthorized entries. Block the four specified IPs. If a compromise is suspected, perform a factory reset and manually reconfigure the router.
