WrtHug Exploits Six ASUS WRT Flaws to Hijack Tens of Thousands of EoL Routers Worldwide

According to SecurityScorecard's STRIKE team, a new campaign dubbed Operation WrtHug has compromised tens of thousands of outdated or end-of-life ASUS WRT routers worldwide, with the majority in Taiwan, the U.S., and Russia and additional infections across Southeast Asia and Europe.

The attackers are believed to exploit six known vulnerabilities in end-of-life ASUS WRT devices to take control of affected routers, and every infected device was found to share a unique self-signed TLS certificate expiring 100 years from April 2022, a detail SecurityScorecard flagged. The vast majority of services presenting the certificate are ASUS AiCloud, a proprietary service enabling access to local storage via the internet, according to the findings.

The report notes that threat actors may leverage command injections and authentication bypasses to deploy persistent backdoors via SSH, mirroring patterns seen in other China-linked ORBs and botnet networks. While the operator behind WrtHug remains unidentified, SecurityScorecard indicated possible ties to China Nexus actors, suggesting a broader, carefully orchestrated mass-infection effort targeting routers and network devices. The campaign has involved specific ASUS models, including the RT-AC1300G Plus and GT-AC5300 family, among others listed in the report.