InfoSecBulletin Cybersecurity for mankind
SecurityScorecard research, in consultation with ASUS, details Operation “WrtHug,” a widespread compromise of ASUS routers. It leverages the proprietary AiCloud service with Nth day vulnerabilities in order to gain high privileges on End-Of-Life ASUS WRT routers. A shared, self-signed TLS certificate with an unusually long 100-year expiration identifies compromised devices.
This campaign impacts thousands of unique devices globally, mainly in Taiwan, the U.S., and Russia, with some effects in Southeast Asia and Europe. Researchers found that hackers are exploiting six vulnerabilities: CVE-2023-41345, CVE-2023-41346, CVE-2023-41347, CVE-2023-41348, CVE-2024-12912, and CVE-2025-2492.
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
STRIKE’s intelligence assessment finds the targeted devices, methods, and timing mirror previous intrusion campaigns linked to China Nexus actors. They are not unlike the LapDogs ORB, which the STRIKE threat intelligence team recently uncovered.
Vulnerabilities CVE-2023-41345, CVE-2023-41346, and CVE-2023-41347 are linked to the command injection issue CVE-2023-39780, which is part of a suspected China-related operation called “AyySSHush” targeting ASUS devices, as reported by GreyNoise.
This research shows that malicious actors increasingly target routers and network devices for mass infections. These operations are often, but not exclusively, associated with Chinese Nexus actors who plan their campaigns meticulously to widen their influence.
State-sponsored Operational Relay Box (ORB) intrusion campaigns are increasing globally. Operation WrtHug sheds light on this trend, aligning with the tactics of China Nexus threat actors and their geopolitical interests, with nearly half of the network’s nodes in Taiwan.
The operation comprises:
• Thousands of compromised devices worldwide.
• The hackers appear to exclusively target ASUS WRT routers.
• Most devices appear to be End-Of-Life (EoL) devices, compromised via Nth day vulnerabilities
leveraging the AiCloud service and OS injection vulnerabilities.
• Compromised devices present a self-signed TLS certificate with an unusually long expiration period.
• 30-50% of targeting is centralized in Taiwan, with other clusters of targets in South Korea, Japan, Hong
Kong, Russia, central Europe, and the United States.
• Attack pattern and vulnerability severity indicate potential Command Injection capabilities if not
Root-level privileges
