Researchers from the cybersecurity firm GreyNoise reported this week that an ongoing exploitation campaign is targeting over 9,000 internet-exposed ASUS routers. Cybercriminals gained long-term access by exploiting an undisclosed vulnerability. Experts suggest that attackers were planning on building a robot network (botnet). According to GreyNoise’s report , the attackers carried out a stealthy and sophisticated operation by using brute-force login attempts and exploiting the CVE-2023-39780 vulnerability — a command injection flaw — to execute system commands on vulnerable devices. The unknown actors enabled SSH access on TCP port 53282 and implanted a backdoor in non-volatile memory (NVRAM), allowing them to maintain remote access even after the device reboots or firmware upgrades. GreyNoise noticed the unusual, low-profile network activity through their AI-powered analysis tool, Sift, in March and reported it. The researchers confirmed that no malware had been installed, but the ...