ASUS confirms its software update tool has been targeted by Advanced Persistent Threat attacks, releases tool to identify “small number” of affected devices
A press release released by ASUS this morning confirms Motherboard's reporting. — Yesterday, Motherboard revealed …
Context & Ripple Effects
This is ASUS moving from silence to incident response. Kaspersky had already disclosed that ASUS pushed a malicious backdoor to roughly 500K Windows machines over at least five months through its compromised live update tool — first reported by Motherboard — and this press release confirms the company now frames it as Advanced Persistent Threat activity rather than ordinary malware.
The confirmation lands amid compounding security scrutiny: a researcher had warned ASUS about hacking risks just weeks earlier after finding staff passwords exposed in public GitHub repos, and later reporting would group the ASUS backdoor with CCleaner and other supply chain compromises attributed to a likely Chinese-speaking hacking group.
First-order effects
- Owners of machines that downloaded the tainted update finally get a way to check exposure: ASUS ships a detection tool aimed at identifying the 'small number' of devices actually infected, narrowing Kaspersky's ~500K download figure to confirmed victims.
- ASUS's public posture flips from unaddressed disclosure to acknowledged APT attack, putting its own update infrastructure under active investigation rather than third-party reporting alone.
Second-order effects
- The earlier warning about ASUS passwords published to GitHub stops looking like an isolated hygiene lapse and becomes evidence in a broader security-culture critique competitors and enterprise buyers will weigh when assessing ASUS hardware fleets.
- Security vendors gain a marquee case study: Kaspersky's discovery, paired with the later attribution linking six supply chain attacks including CCleaner, makes compromised vendor update channels a headline threat category for endpoint protection marketing and research agendas.
Third-order effects
- If the pattern holds — trusted vendor update tools as the intrusion vector of choice for state-linked actors — every PC maker faces pressure to adopt signed, verifiable update delivery and assume its distribution channel is a target, not a utility.
- The episode foreshadows the long tail seen in the related GreyNoise botnet infecting thousands of ASUS routers with persistent SSH backdoors: once a vendor's trust boundary is breached, attackers treat its whole device ecosystem as reusable infrastructure.
The trend: Nation-state actors are increasingly attacking the software supply chain itself — compromising vendor update tools so the victim's own trusted channel delivers the malware.