Operation WrtHug hijacks 50,000+ ASUS routers to Bìbuild global botnet

Operation WrtHug has hijacked tens of thousands of outdated ASUS WRT routers to form a large botnet, with infections reported worldwide and concentrations in Taiwan, the U.S., and Russia, and infections also appearing across Southeast Asia and Europe. The attackers are said to have exploited six known flaws in end‑of‑life devices to gain control, and all compromised devices share a long‑lived self‑signed TLS certificate valid for 100 years from April 2022, with 99% of systems using it running ASUS AiCloud.

The campaign reportedly leveraged multiple vulnerabilities, including OS command injection (CVE-2023-41345 to CVE-2023-41348), arbitrary command execution (CVE-2024-12912), and improper authentication (CVE-2025-2492), to access AiCloud for initial access, and the botnet now numbers over 50,000 devices.

Experts attribute the operation to China‑linked actors aiming to build a persistent espionage network, with suggestions of coordination with the AyySSHush botnet; taìhat the AyySSHush botnet had hacked over 9,000 ASUS routers was noted. According to SecurityScorecard, this report highlights the risks of end‑of‑life devices and the need for vigilant monitoring, and ASUS has addressed all the targeted vulnerabilities.