Massive Hacking Operation WrtHug Compromises Thousands of ASUS Routers Worldwide

A sophisticated cyber campaign known as Operation WrtHug has hijacked tens of thousands of ASUS WRT routers globally, turning them into potential espionage tools for suspected China-linked hackers.

SecurityScorecard’s STRIKE team, in collaboration with ASUS, revealed the operation on November 18, 2025, highlighting how attackers exploited outdated firmware to build a stealthy network infrastructure.

This breach underscores the rising threat to end-of-life consumer devices, with infections concentrated in Taiwan and spreading to the U.S., Russia, and Southeast Asia.​

Researchers first detected Operation WrtHug through a suspicious self-signed TLS certificate shared across compromised devices, featuring an unusually long 100-year expiration date from April 2022.

This certificate, with SHA1 thumbprint 1894a6800dff523894eba7f31cea8d05d51032b4, appeared on 99% of affected ASUS AiCloud services, a feature meant for remote home network access but now exploited as an entry point.

The campaign targets exclusively ASUS WRT models, many of which are end-of-life and unpatched, allowing attackers to inject commands and gain root privileges without altering the device’s outward appearance.

The operation’s scale is alarming, with estimates of 50,000 unique IP addresses involved over the past six months, based on proprietary scans and tools like Driftnet.

Unlike random botnets, WrtHug shows a deliberate geographic focus, infecting 30-50% of devices in Taiwan, a pattern that aligns with geopolitical tensions. Smaller clusters hit South Korea, Japan, Hong Kong, central Europe, and the U.S., but mainland China remains largely untouched, aside from Hong Kong.

Exploited Vulnerabilities

Attackers chained six known flaws in ASUS firmware to propagate the malware, focusing on N-day exploits in AiCloud and OS injection vectors, SecurityScorecard said to CybersecurityNews.

These vulnerabilities, all patched by ASUS, primarily affect outdated routers running lighttpd or Apache web servers.

The table below details the key CVEs, their impacts, and prerequisites:​

CVE ID	Affected Products	Impact	Exploit Prerequisites	CVSS Score
CVE-2023-41345	ASUS WRT routers	OS command injection	Authenticated access, token module flaw	8.8
CVE-2023-41346	ASUS WRT routers	OS command injection	Authenticated access, token module flaw	8.8
CVE-2023-41347	ASUS WRT routers	OS command injection	Authenticated access, token module flaw	8.8
CVE-2023-41348	ASUS WRT routers	OS command injection	Authenticated access, token module flaw	8.8
CVE-2024-12912	ASUS WRT routers	Arbitrary command execution	Remote access via AiCloud	7.2
CVE-2025-2492	ASUS WRT routers	Unauthorized function execution	Improper authentication control	9.2

These flaws link to CVE-2023-39780, a command injection bug tied to the earlier AyySSHush campaign, suggesting possible actor overlap. Seven IPs show dual compromise, hinting at coordinated efforts.

STRIKE assesses low-to-moderate confidence that China Nexus actors drive WrtHug, mirroring tactics in ORBs like LapDogs and PolarEdge. The focus on Taiwan and router persistence via SSH backdoors points to espionage infrastructure building.

This fits a trend of state-sponsored router hijacks, evolving from brute-force to multi-stage infections.

Targeted models include RT-AC1200HP, GT-AC5300, and DSL-AC68U, often in homes or small offices. While post-exploitation details remain unclear, the setup enables proxying C2 traffic and data exfiltration.

Indicators of Compromise

Monitoring for these IOCs can help detect infections:

Indicator Type	Value	Details
SHA-1	1894a6800dff523894eba7f31cea8d05d51032b4	WrtHug TLS certificate thumbprint
IPv4	46[.]132.187.85	Dual-compromised (WrtHug/AyySSHush)
IPv4	46[.]132.187.24	Dual-compromised (WrtHug/AyySSHush)
IPv4	221[.]43.126.86	Dual-compromised (WrtHug/AyySSHush)
IPv4	122[.]100.210.209	Dual-compromised (WrtHug/AyySSHush)

Additional IPs: 59.26.66[.]44, 83.188.236[.]86, 195.234.71[.]218

ASUS urges firmware updates and disabling unused features like AiCloud on supported devices. For EoL models, replacement is recommended, alongside network segmentation and TLS certificate monitoring.

Organizations should scan for the IOC certificate and apply CISA’s known exploited catalog patches.

As router attacks escalate in 2025, this incident highlights the need for vigilant SOHO security to thwart nation-state probing. SecurityScorecard calls for industry collaboration to counter such calculated threats.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.