InfoSecBulletin Cybersecurity for mankind
SecurityScorecard research, in consultation with ASUS, details Operation “WrtHug,” a widespread compromise of ASUS routers. It leverages the proprietary AiCloud service with Nth day vulnerabilities in order to gain high privileges on End-Of-Life ASUS WRT routers. A shared, self-signed TLS certificate with an unusually long 100-year expiration identifies compromised devices.
This campaign impacts thousands of unique devices globally, mainly in Taiwan, the U.S., and Russia, with some effects in Southeast Asia and Europe. Researchers found that hackers are exploiting six vulnerabilities: CVE-2023-41345, CVE-2023-41346, CVE-2023-41347, CVE-2023-41348, CVE-2024-12912, and CVE-2025-2492.
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
STRIKE’s intelligence assessment finds the targeted devices, methods, and timing mirror previous intrusion campaigns linked to China Nexus actors. They are not unlike the LapDogs ORB, which the STRIKE threat intelligence team recently uncovered.
Vulnerabilities CVE-2023-41345, CVE-2023-41346, and CVE-2023-41347 are linked to the command injection issue CVE-2023-39780, which is part of a suspected China-related operation called “AyySSHush” targeting ASUS devices, as reported by GreyNoise.
This research shows that malicious actors increasingly target routers and network devices for mass infections. These operations are often, but not exclusively, associated with Chinese Nexus actors who plan their campaigns meticulously to widen their influence.
State-sponsored Operational Relay Box (ORB) intrusion campaigns are increasing globally. Operation WrtHug sheds light on this trend, aligning with the tactics of China Nexus threat actors and their geopolitical interests, with nearly half of the network’s nodes in Taiwan.
The operation comprises:
• Thousands of compromised devices worldwide.
• The hackers appear to exclusively target ASUS WRT routers.
• Most devices appear to be End-Of-Life (EoL) devices, compromised via Nth day vulnerabilities
leveraging the AiCloud service and OS injection vulnerabilities.
• Compromised devices present a self-signed TLS certificate with an unusually long expiration period.
• 30-50% of targeting is centralized in Taiwan, with other clusters of targets in South Korea, Japan, Hong
Kong, Russia, central Europe, and the United States.
• Attack pattern and vulnerability severity indicate potential Command Injection capabilities if not
Root-level privileges
