New Botnet Plants Persistent Backdoors in ASUS Routers

Researchers uncovered AyySSHush, a router-focused botnet that compromises ASUS devices via brute force and a high-severity command-injection flaw (CVE-2023-39780), undermines built-in security, and implants persistent SSH backdoors in NVRAM so infections survive reboots and firmware updates; the campaign likely enrolled thousands of routers into a larger ORB relay network (≈12,000 peak, ≈4,500 remaining) and is assessed as likely Chinese-linked (ViciousTrap).