[mwchang]

New AyySSHush botnet compromised over 9,000 ASUS routers, adding a persistent SSH backdoor.
May 29, 2025
https://securityaffairs.com/178413/malware/new-ayysshush-botnet-compromised-over-9000-asus-routers-adding-a-persistent-ssh-backdoor.html

GreyNoise discovered the AyySSHush botnet has hacked over 9,000 ASUS routers, adding a persistent SSH backdoor.

“Using an AI powered network traffic analysis tool we built called SIFT, GreyNoise has caught multiple anomalous network payloads with zero-effort that are attempting to disable TrendMicro security features in ASUS routers, then exploit vulnerabilities and novel tradecraft in ASUS AiProtection features on those routers.” states GreyNoise.

... more ....

The payloads observed by the experts only target ASUS RT-AC3100 or RT-AC3200 with an Out-Of-Box configuration.

GreyNoise also found a payload exploiting the authenticated command injection flaw CVE-2023-39780 in ASUS RT-AX55 v3.0.0.4.386.51598 to execute arbitrary system commands.

The attackers exploit the command injection flaw to add their SSH key and enable access on port 53282, ensuring persistent backdoor access across reboots and updates.

... more ....



Related:

AyySSHush: Tradecraft of an emergent ASUS botnet – GreyNoise Labs
May 28, 2025
https://www.labs.greynoise.io/grimoire/2025-03-28-ayysshush/

華碩路由器遭殭屍網路AyySSHush綁架 - 電腦資訊轉貼
https://www.hkepc.com/forum/viewthread.php?fid=110&tid=2748957

[mrjlaunch]

So this issue affects the RT-AC3100 and RT-AC3200. The Greynoise article also confirms the RT-AX55 is susceptible.

Now I'm wondering if my vanilla DSL-AC88U would be affected.

What precautions can I take to prevent the exploit? And is flashing to WRT going to close the exploit?

[kernel-panic69]

There are no third-party firmware projects that support the DSL combo devices 100%. Your device is EOL, and the most recent GPL tarball is not for the latest release of stock firmware. IOW, there is no fixing it unless you know how to finesse some patches and updates to the latest 2019 GPL tarball (GPL of ASUS DSL-AC88U Annex A for firmware 1.10.06_Build591) and roll your own firmware image.

https://www.asus.com/networking-iot-servers/modem-routers/all-series/dsl-ac88u/helpdesk_bios?model2Name=DSL-AC88U

[mrjlaunch]

Thanks for the reply, though that's upsetting, I only bought my AC88U in 2022.

Making my own firmware is waaaaaay beyond my skill level.

Is there a way I can prevent the exploit on my AC88U, ie. turning off WAN remote access?

[Per Yngve Berg]

Put it in Bridge Mode and have a dd-wrt router behind it.