InfoSecBulletin Cybersecurity for mankind
SecurityScorecard research, in consultation with ASUS, details Operation “WrtHug,” a widespread compromise of ASUS routers. It leverages the proprietary AiCloud service with Nth day vulnerabilities in order to gain high privileges on End-Of-Life ASUS WRT routers. A shared, self-signed TLS certificate with an unusually long 100-year expiration identifies compromised devices.
This campaign impacts thousands of unique devices globally, mainly in Taiwan, the U.S., and Russia, with some effects in Southeast Asia and Europe. Researchers found that hackers are exploiting six vulnerabilities: CVE-2023-41345, CVE-2023-41346, CVE-2023-41347, CVE-2023-41348, CVE-2024-12912, and CVE-2025-2492.
Mysterious AI model “Ox Alpha” with free 100 trillion tokens a day for coders
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
STRIKE’s intelligence assessment finds the targeted devices, methods, and timing mirror previous intrusion campaigns linked to China Nexus actors. They are not unlike the LapDogs ORB, which the STRIKE threat intelligence team recently uncovered.
Vulnerabilities CVE-2023-41345, CVE-2023-41346, and CVE-2023-41347 are linked to the command injection issue CVE-2023-39780, which is part of a suspected China-related operation called “AyySSHush” targeting ASUS devices, as reported by GreyNoise.
This research shows that malicious actors increasingly target routers and network devices for mass infections. These operations are often, but not exclusively, associated with Chinese Nexus actors who plan their campaigns meticulously to widen their influence.
State-sponsored Operational Relay Box (ORB) intrusion campaigns are increasing globally. Operation WrtHug sheds light on this trend, aligning with the tactics of China Nexus threat actors and their geopolitical interests, with nearly half of the network’s nodes in Taiwan.
The operation comprises:
• Thousands of compromised devices worldwide.
• The hackers appear to exclusively target ASUS WRT routers.
• Most devices appear to be End-Of-Life (EoL) devices, compromised via Nth day vulnerabilities
leveraging the AiCloud service and OS injection vulnerabilities.
• Compromised devices present a self-signed TLS certificate with an unusually long expiration period.
• 30-50% of targeting is centralized in Taiwan, with other clusters of targets in South Korea, Japan, Hong
Kong, Russia, central Europe, and the United States.
• Attack pattern and vulnerability severity indicate potential Command Injection capabilities if not
Root-level privileges
