{
  "name": "Thousands of ASUS Routers Hijacked in Stealthy Backdoor Campaign",
  "slug": "thousands-of-asus-routers-hijacked-in-stealthy-backdoor-campaign",
  "description": "A sophisticated hacking campaign has compromised approximately 9000 ASUS routers, creating persistent backdoors that survive firmware updates and reboots. The attackers utilize the routers' legitimate features to maintain long-term access without dropping malware or leaving traces. This operation appears to be assembling a distributed network of backdoor devices, potentially for a future botnet. The intrusion chain involves brute-force login attempts, exploitation of zero-day vulnerabilities, and the use of CVE-2023-39780. The attackers employ stealthy techniques such as enabling SSH access on a custom port, inserting attacker-controlled public keys, and disabling router logging. The campaign's sophistication suggests a formidable and well-funded adversary, possibly associated with Chinese-sponsored hackers.",
  "published": "2025-05-29T14:10:35+00:00",
  "created_at": "2025-05-29T14:10:35+00:00",
  "modified_at": "2025-05-29T17:33:46+00:00",
  "created_at_opencti": "2025-05-29T14:10:35+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-05-29",
    "CVE-2023-39780",
    "asus routers",
    "backdoor",
    "botnet",
    "operational relay box",
    "ssh access"
  ],
  "related_entities": {
    "attack_patterns": [
      {
        "id": "f65930b0-5581-4f3d-a367-a86ac78f407b",
        "name": "T1021.004"
      },
      {
        "id": "444de5e0-bd7f-4700-b700-26320057dd80",
        "name": "T1110"
      },
      {
        "id": "2e0c6db7-16a7-4bf6-992e-263474014fce",
        "name": "T1059.004"
      },
      {
        "id": "747c7b95-79ff-4132-8ea5-397cb6665ebd",
        "name": "T1498"
      },
      {
        "id": "6c8f8a40-2746-4a37-86bd-81e82afa6e62",
        "name": "T1190"
      },
      {
        "id": "b9eab970-53dd-4977-9a26-c4fe566e422d",
        "name": "T1133"
      },
      {
        "id": "9f11a241-9abc-4c57-95dd-33955ab08826",
        "name": "T1078"
      }
    ]
  },
  "external_refs": [
    "https://www.infosecurity-magazine.com/news/thousands-asus-routers-compromised",
    "https://otx.alienvault.com/pulse/683886fb0eae29046fb00608"
  ]
}