Thousands of Asus routers are being hit with stealthy, persistent backdoors

Stembolt

Thousands of home and small office routers manufactured by Asus are being infected with a stealthy backdoor that can survive reboots and firmware updates in an attack by a nation-state or another well-resourced threat actor, researchers said.

The unknown attackers gain access to the devices by exploiting now-patched vulnerabilities, some of which have never been tracked through the internationally recognized CVE system.

urbanriot

Stembolt the CVE suggests it needs authentication to exploit so presumably they’re only hacked if the user has a weak password and a threat actor is already on the network or someone has stupidly enabled remote management.

bennor

Earlier topic posted in the networking subforum:
https://broadbandbulletin.com/d/3391-thousands-of-asus-routers-are-being-hit-with-stealthy-persistent-backdoors

Anyway…
https://www.greynoise.io/blog/stealthy-backdoor-campaign-affecting-asus-routers
https://www.labs.greynoise.io/grimoire/2025-03-28-ayysshush/

From the arstechnica article:

The attackers are backdooring the devices by exploiting multiple vulnerabilities. One is CVE-2023-39780, a command-injection flaw that allows for the execution of system commands, which Asus patched in a recent firmware update, GreyNoise said. The remaining vulnerabilities have also been patched but, for unknown reasons, have not received CVE tracking designations.

The only way for router users to determine whether their devices are infected is by checking the SSH settings in the configuration panel. Infected routers will show that the device can be logged in to by SSH over port 53282 using a digital certificate with a truncated key of: ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAo41nBoVFfj4HlVMGV+YPsxMDrMlbdDZ…

To remove the backdoor, infected users should remove the key and the port setting.

People can also determine if they’ve been targeted if system logs indicate that they have been accessed through the IP addresses 101.99.91[.]151, 101.99.94[.]173, 79.141.163[.]179, or 111.90.146[.]237. Users of any router brand should always ensure their devices receive security updates in a timely manner.

Or one can update to the latest firmware for their Asus router, then do a hard factory reset on their Asus router followed by a manual configuration. Do not import a saved router.cfg file.

egeezer

Just for due diligence, I checked my logs, netstat and system settings. All is good and SSH and telnet are turned off. Firmware is current. I also saved my current known good cfg just in case I need it.

StyxKee

How to block those IP address on the Asus Router listed in the article?

codezer0

Would this apply, if the Asus router in question is using a not Asus firmware? The only one I have is presently using dd-wrt, as a wireless bridge.

egeezer

codezer0
The article and CVE didn’t address DD-WRT. You may want to check the release notes for your flavor of the firmware, and check for the settings and open port described in the CVE.