A widespread security issue has been discovered affecting thousands of Asus routers. Attackers have gained remote access through a hidden backdoor, potentially creating a network of compromised devices for future malicious use.
To check if your router is affected, open its web interface and verify if SSH access is enabled. Look specifically for a public SSH key beginning with ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAo41nBoVFfj4HlVMGV+YPsxMDrMlbdDZ...
If this key is present, your router is compromised. Simply updating the firmware will not fix the issue. You should manually disable SSH access immediately.
https://www.greynoise.io/blog/stealthy-backdoor-campaign-aff…
GreyNoise has identified an ongoing exploitation campaign in which attackers have gained unauthorized, persistent access to thousands of ASUS routers exposed to the internet. This appears to be part of a stealth operation to assemble a distributed network of backdoor devices — potentially laying the groundwork for a future botnet.
Update: 30 May 2025.
If your router has been accessed, the best thing you can do is a factory reset, advises PCMag security analyst Kim Key. This attack is a formidable one, GreyNoise says, because it "survives both reboots and firmware updates, giving them durable control over affected devices." A factory reset will get around this. In most other cases, updating the firmware would've solved the problem.
Asus also recommends you remove or disable the SSH entry and block the following four IP addresses, according to ZDNet:
101.99.91.151
101.99.94.173
79.141.163.179
111.90.146.237If your router was not accessed, update the firmware to prevent any future issues. Asus fixed the CVE-2023-39780 flaw with its latest firmware update.
https://au.pcmag.com/wireless-routers/111311/cybercriminals-…
hehe backdoor