Over 50,000 Asus Routers Hacked in ‘Operation WrtHug’

A Chinese state-sponsored threat actor is alleged to have compromised tens of thousands of Asus routers to establish a persistent network in support of global espionage campaigns, according to SecurityWeek’s reporting. The infections are linked to an Operational Relay Box campaign dubbed Operation WrtHug, with attackers exploiting known AiCloud service vulnerabilities, including CVE-2023-41345, CVE-2023-41346, CVE-2023-41347, CVE-2023-41348, and CVE-2023-39780, plus CVE-2024-12912 and CVE-2025-2492.

On compromised devices, mostly discontinued models, the hackers installed a shared self-signed TLS certificate with a 100-year expiry from April 2022, which SecurityScorecard notes can serve as an IoC. SecurityScorecard’s STRIKE team identified over 50,000 unique IP addresses belonging to these compromised routers over the last six months, with most devices located in Taiwan and clusters in the US, Russia, Southeast Asia and Europe.

The piece also notes that this is the second China-linked ORB operation targeting Asus routers after the AyySSHush network, and urges users to patch or replace affected devices. The report was published on 20 November 2025.