Operation WrtHug Hijacks Tens of Thousands ASUS Routers

Massive Infection: Tens of thousands of end-of-life ASUS WRT routers compromised worldwide, mainly in Taiwan, the US, and Russia.
Exploit Details: Campaign leverages six known CVEs to take control and deploy backdoors via SSH under “Operation WrtHug.”
Unique Signature: All infected routers use the same self-signed TLS certificate, expiring 100 years from April 2022.
Targeted Models: Includes popular ASUS Wireless Router models such as 4G-AC55U, GT-AX11000, RT-AC1300UHP, among others.
Threat Actor Profile: Likely linked to Chinese hacking groups, showing careful expansion and persistent backdoors even after reboots or updates.

SecurityScorecard’s STRIKE team first identified the widespread campaign, noting the attackers chain command injections and authentication bypasses to maintain access. The attack bears similarities with other operations like AyySSHush, LapDogs, and PolarEdge, suggesting possible overlap or links between these China-affiliated groups. Data logs show heavy blocking of non-target regions while focusing on Brazil and Argentina via geo-fencing. Despite the Brazilian origin of much malware, the infection footprint and exposed systems are global.

Administrators should watch for suspicious TLS certificates, unexpected SSH activity, and signs of persistence even after firmware updates on their ASUS WRT routers. Patching vulnerable CVEs, disabling AiCloud access where unneeded, and monitoring traffic can mitigate ongoing risks from this campaign.