Malwarecritical
Thousands of ASUS Routers Hijacked in Stealthy Backdoor Campaign
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-39780 | Authenticated OS Command Injection in ASUS RT-AX55 Routers | 8.8 | 40% | KEVPoC ×7 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 101.99.91.151 | unauthorized entries Block the following four IP addresses: 101.99.91.151; 101.99.94.173; 79.141.163.179; 111.90.146.237 If a comprom |
| ipv4 | 101.99.94.173 | tries Block the following four IP addresses: 101.99.91.151; 101.99.94.173; 79.141.163.179; 111.90.146.237 If a compromise is suspecte |
| ipv4 | 111.90.146.237 | IP addresses: 101.99.91.151; 101.99.94.173; 79.141.163.179; 111.90.146.237 If a compromise is suspected, perform a full factory reset |
| ipv4 | 79.141.163.179 | following four IP addresses: 101.99.91.151; 101.99.94.173; 79.141.163.179; 111.90.146.237 If a compromise is suspected, perform a ful |
From the original article
2 min read at infosecurity-magazine.com
Hackers have gained unauthorized, persistent access to about 9000 ASUS routers in an ongoing exploitation campaign, according to cyber intelligence firm GreyNoise. Unlike typical malware attacks, the attackers maintain long-term access without dropping malware or leaving traces. Instead, the operation uses the routers’ own legitimate features to create persistent backdoors that survive firmware updates and reboots.
By Kevin Poireault · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.