Uncovering a Hidden Threat: Thousands of Asus Routers Compromised by Stealthy Backdoors

GreyNoise recently identified a concerning cyber campaign that began in mid-March. They held back on publicizing it until they informed certain government agencies, hinting at possible ties to a nation-state actor.

Their findings align with those of another security firm, Sekoia. Researchers there reported that Internet scanning data indicates around 9,500 Asus routers might be compromised by a threat dubbed "ViciousTrap." This name is used to describe the unnamed group behind the attacks.

The attackers exploit multiple vulnerabilities to gain access to these devices. One notable flaw is CVE-2023-39780, which allows hackers to run system commands. Though Asus has released a firmware update to fix this issue, other vulnerabilities remain untracked, raising questions about their status.

For users, recognizing an infected router can be tricky. The main indicator is found in the SSH settings of the router’s configuration panel. If your device shows it can be accessed via SSH on port 53282 with a specific truncated key, it may be compromised.

To remove the threat, users should eliminate the suspicious key and port setting. Additionally, logs indicating access from certain IP addresses—like 101.99.91[.]151—can signal a breach.

Keeping devices updated is crucial. A recent survey found that up to 60% of users neglect timely updates, making them easy targets for cyber threats. According to cybersecurity expert Dr. Lisa Harrington, "Regularly updating firmware is one of the simplest yet most effective ways to protect against vulnerabilities."

As digital life expands, staying vigilant is more important than ever. Awareness and timely action can help safeguard your devices against potential breaches. For more detailed insights, you can refer to the Censys search findings.

Source link