Get the latest tech news
9,000 Asus routers compromised by botnet attack and persistent SSH backdoor that even firmware updates can't fix
The backdoor evades detection and survives firmware updates
The attack begins with threat actors targeting the routers through brute-force login attempts and exploiting authentication bypass techniques, some of which remain undocumented without assigned CVEs. You may like According to GreyNoise’s report, the techniques used by the attackers suggest thorough planning for long-term access and demonstrate a deep knowledge of the system’s architecture. To ensure routers are fully secured, users are advised to take additional manual steps, including checking for active SSH access on TCP port 53282, reviewing the authorized_keys file for unfamiliar entries, and blocking the known malicious IP addresses that may be associated with the campaign.
Or read this on r/technology