- Thousands of Expired ASUS Routers Hijacked in “Operation WrtHug” Cyberespionage Botnet
- Chinese state-sponsored actors exploit multiple n-day flaws using 100-year TLS certificates
- Compromised routers form relay networks, mostly in Taiwan and Southeast Asia
Thousands of expired ASUS routers are being hijacked and assimilated into a botnet used as infrastructure for cyberespionage operations, experts have warned.
Security researchers SecurityScorecard, along with Asus, discovered and reported the malicious campaign, claiming that a group of Chinese state-sponsored threat actors exploited multiple vulnerabilities in a number of ASUS routers to deploy a unique, self-signed certificate.
The vulnerabilities being exploited include CVE-2023-41345, CVE-2023-41346, CVE-2023-41347, CVE-2023-41348, CVE-2024-12912, and CVE-2025-2492. These are all n-day errors, meaning they have been around for a relatively long time. However, when the targeted endpoints reached their end-of-life, most never received the update or were simply not patched by their users.
Chinese activity
Here is the list of the models being assimilated into the botnet:
4G-AC55U
4G-AC860U
DSL-AC68U
GT-AC5300
GT-AX11000
RT-AC1200HP
RT-AC1300GPLUS
RT-AC1300UHP
The number of hijacked routers is counted “in the thousands,” according to the report. They all share a unique, self-signed TLS certificate with an expiration date of 100 years.
“This unusually long-lived certificate is a critical indicator of compromise and points to a level of coordination that reflects careful and calculated espionage,” the researchers said.
The infected routers become part of a large operational relay network similar to other China-linked Operational Relay Box (ORB) campaigns.
The routers become hubs that let the actors route their own espionage traffic through innocent people’s routers, conceal their true origins when conducting intrusions, build a robust, globally distributed C2 infrastructure, and ultimately stage attacks against high-value geopolitical targets.
The vast majority of compromised routers are located in Taiwan and Southeast Asia, which perfectly suits Chinese national interests. No compromised routers were found in mainland China, it said.
The campaign is dubbed “Operation WrtHug” as the devices run firmware called AsusWRT.
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews and opinions in your feeds. Be sure to click the Follow button!
And of course you can too follow TechRadar on TikTok for news, reviews, video unboxings, and get regular updates from us on WhatsApp also.
