More than 9,000 ASUS routers have been compromised in a months-long hacking campaign that researchers from GreyNoise warn may be a prelude to the creation of a botnet.
Hackers are breaching routers through brute-force login attempts and authentication bypasses that rely on a command injection vulnerability, tracked as CVE-2023-39780, to execute system commands, GreyNoise researchers said in a blog post on Wednesday.
GreyNoise first detected suspicious activity in March, when it flagged three suspicious HTTP POST requests made to ASUS routers, according to Matthew Remacle, senior researcher at GreyNoise.
ASUS released a patch for the vulnerability in a recent firmware update, but the initial bypass attempts have not received CVEs, according to GreyNoise. In addition, researchers say, if a router was compromised before the firmware was updated, a backdoor will still remain on the devices unless secure shell protocol access is explicitly disabled.
GreyNoise’s count of the number of affected devices is based on scans from Censys.
Researchers have not attributed the hacking campaign, but the tactics being used are consistent with those of advanced persistent threat (APT) groups. The hackers will remain in control of the devices even after reboots and firmware upgrades.
GreyNoise said government officials and industry partners asked the company to delay public disclosure while they coordinated the process of disclosing and fixing the flaws.
A spokesperson for the Cybersecurity and Infrastructure Security Agency (CISA) declined to comment on the disclosure and referred questions to ASUS.
A Sekoia report released last week links the hacking campaign to a threat actor dubbed ViciousTrap, which compromised more than 5,500 devices in an attempt to create a network similar to a honeypot.
ViciousTrap has been monitoring a wide variety of edge devices, including small office/home office (SOHO) routers, baseboard management controllers, digital video recorders and other devices, with the goal of trying to exploit vulnerabilities in them, according to Sekoia researchers.
The firm linked ViciousTrap to the exploitation of a vulnerability in the web management interface of Cisco Small Business routers, tracked as CVE-2023-20118. The vulnerability allows an attacker to gain root-level privileges and access unauthorized data.
Cisco said it would not release updates to address the vulnerability, but it issued guidance to help administrators disable an affected feature in the devices.
