GreyNoise researchers detail a novel botnet infecting 9K+ routers from Asus and others with a persistent SSH backdoor, enabling access after reboots and updates
Over 9,000 ASUS routers are compromised by a novel botnet dubbed “AyySSHush” that was also observed targeting SOHO routers from Cisco, D-Link, and Linksys.
Context & Ripple Effects
Consumer and SOHO routers have a long record as durable footholds: earlier research documented self-sustaining botnets built from poorly secured routers, while Cisco router compromises showed how stealthy backdoors can persist across distributed device fleets.
The newly documented activity matters because it places ASUS alongside Cisco, D-Link, and Linksys in a cross-vendor targeting pattern, rather than an isolated endpoint-malware event. It also follows research on router malware that could move from network devices to Windows, macOS, and Linux systems, underscoring the router’s position at the network edge.
First-order effects
- Owners of affected ASUS routers face an active persistence problem: a reboot or routine update may not remove the SSH backdoor, requiring more deliberate remediation and credential review.
- ASUS is immediately pressured to investigate the affected population and provide clear detection and recovery guidance; Cisco, D-Link, and Linksys must assess exposure from observed targeting.
Second-order effects
- Organizations and households that rely on SOHO equipment may tighten router inventory, remote-management, and segmentation practices, because a compromised gateway can remain reachable after standard maintenance.
- Cross-vendor targeting raises the value of threat intelligence and device-level monitoring for router makers and managed-service providers, rather than treating each brand’s incidents as separate events.
Third-order effects
- If persistent router compromises continue, consumer and SOHO gateways will increasingly be managed as long-lived security endpoints with explicit recovery, visibility, and support-lifecycle requirements.
- The pattern reinforces a broader shift from opportunistic botnets toward campaigns that preserve access at the network edge and can potentially support follow-on intrusion activity.
The trend: Persistent, cross-vendor compromise of SOHO routers is making edge-device security and recoverability a core part of endpoint defense.