InfoSecBulletin Cybersecurity for mankind
SecurityScorecard research, in consultation with ASUS, details Operation “WrtHug,” a widespread compromise of ASUS routers. It leverages the proprietary AiCloud service with Nth day vulnerabilities in order to gain high privileges on End-Of-Life ASUS WRT routers. A shared, self-signed TLS certificate with an unusually long 100-year expiration identifies compromised devices.
This campaign impacts thousands of unique devices globally, mainly in Taiwan, the U.S., and Russia, with some effects in Southeast Asia and Europe. Researchers found that hackers are exploiting six vulnerabilities: CVE-2023-41345, CVE-2023-41346, CVE-2023-41347, CVE-2023-41348, CVE-2024-12912, and CVE-2025-2492.
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
CIRT identified 153 publicly exposed FortiGate devices in Bangladesh
STRIKE’s intelligence assessment finds the targeted devices, methods, and timing mirror previous intrusion campaigns linked to China Nexus actors. They are not unlike the LapDogs ORB, which the STRIKE threat intelligence team recently uncovered.
Vulnerabilities CVE-2023-41345, CVE-2023-41346, and CVE-2023-41347 are linked to the command injection issue CVE-2023-39780, which is part of a suspected China-related operation called “AyySSHush” targeting ASUS devices, as reported by GreyNoise.
This research shows that malicious actors increasingly target routers and network devices for mass infections. These operations are often, but not exclusively, associated with Chinese Nexus actors who plan their campaigns meticulously to widen their influence.
State-sponsored Operational Relay Box (ORB) intrusion campaigns are increasing globally. Operation WrtHug sheds light on this trend, aligning with the tactics of China Nexus threat actors and their geopolitical interests, with nearly half of the network’s nodes in Taiwan.
The operation comprises:
• Thousands of compromised devices worldwide.
• The hackers appear to exclusively target ASUS WRT routers.
• Most devices appear to be End-Of-Life (EoL) devices, compromised via Nth day vulnerabilities
leveraging the AiCloud service and OS injection vulnerabilities.
• Compromised devices present a self-signed TLS certificate with an unusually long expiration period.
• 30-50% of targeting is centralized in Taiwan, with other clusters of targets in South Korea, Japan, Hong
Kong, Russia, central Europe, and the United States.
• Attack pattern and vulnerability severity indicate potential Command Injection capabilities if not
Root-level privileges
