Thousands of hacked Asus routers are under control of suspected China-state hackers

Thousands of Asus routers are reportedly hacked and under the control of a suspected China-state group, researchers say, with the operation named WrtHug and focused on seven models that are no longer supported and thus not receiving security patches. According to SecurityScorecard, compromised devices appear to be concentrated in Taiwan, with smaller clusters in other regions including South Korea and the United States.

The campaign prompts users to install a self-signed TLS certificate during infection, a step that can be misused because the certificate expiry extends to 2122, and the issuer lists as CN=a,OU=a,O=a,L=a,ST=a,C=aa. SecurityScorecard notes that, so far, there has been no observed post-exploit payload in the infected routers, though researchers warn the risk of covert operations and espionage remains a concern.

The seven Asus models identified are the Wireless Router 4G-AC55U, 4G-AC860U, DSL-AC68U, GT-AC5300, GT-AX11000, RT-AC1200HP, RT-AC1300GPLUS, and RT-AC1300UHP, with guidance suggesting users disable features like AICloud and other remote services. The report highlights that the attackers may use any compromised router for various purposes, including potential exploits or direct OS changes, and advises replacing end-of-life routers to ensure ongoing security updates.