InfoSecBulletin Cybersecurity for mankind
SecurityScorecard research, in consultation with ASUS, details Operation “WrtHug,” a widespread compromise of ASUS routers. It leverages the proprietary AiCloud service with Nth day vulnerabilities in order to gain high privileges on End-Of-Life ASUS WRT routers. A shared, self-signed TLS certificate with an unusually long 100-year expiration identifies compromised devices.
This campaign impacts thousands of unique devices globally, mainly in Taiwan, the U.S., and Russia, with some effects in Southeast Asia and Europe. Researchers found that hackers are exploiting six vulnerabilities: CVE-2023-41345, CVE-2023-41346, CVE-2023-41347, CVE-2023-41348, CVE-2024-12912, and CVE-2025-2492.
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
STRIKE’s intelligence assessment finds the targeted devices, methods, and timing mirror previous intrusion campaigns linked to China Nexus actors. They are not unlike the LapDogs ORB, which the STRIKE threat intelligence team recently uncovered.
Vulnerabilities CVE-2023-41345, CVE-2023-41346, and CVE-2023-41347 are linked to the command injection issue CVE-2023-39780, which is part of a suspected China-related operation called “AyySSHush” targeting ASUS devices, as reported by GreyNoise.
This research shows that malicious actors increasingly target routers and network devices for mass infections. These operations are often, but not exclusively, associated with Chinese Nexus actors who plan their campaigns meticulously to widen their influence.
State-sponsored Operational Relay Box (ORB) intrusion campaigns are increasing globally. Operation WrtHug sheds light on this trend, aligning with the tactics of China Nexus threat actors and their geopolitical interests, with nearly half of the network’s nodes in Taiwan.
The operation comprises:
• Thousands of compromised devices worldwide.
• The hackers appear to exclusively target ASUS WRT routers.
• Most devices appear to be End-Of-Life (EoL) devices, compromised via Nth day vulnerabilities
leveraging the AiCloud service and OS injection vulnerabilities.
• Compromised devices present a self-signed TLS certificate with an unusually long expiration period.
• 30-50% of targeting is centralized in Taiwan, with other clusters of targets in South Korea, Japan, Hong
Kong, Russia, central Europe, and the United States.
• Attack pattern and vulnerability severity indicate potential Command Injection capabilities if not
Root-level privileges
