Loading story…
Dutch incident responders found the Alogin and TheMoon malware families concurrently operating on an internet-exposed ASUS RT-AC66U consumer router. Alogin installed a malicious Telnet login handler and a Microsocks SOCKS5 proxy, while a newer TheMoon variant established persistence through loaders and proxy components stored in the router’s writable JFFS partition.
The Netherlands’ NCSC identified about 150 likely compromised SOHO routers domestically and assessed the wider network at roughly 13,000 systems worldwide. Observed activity included low-volume authentication attempts against Microsoft cloud services and SSH brute-force attempts, consistent with the routers being used as intermediary infrastructure. ASUS issued firmware updates for supported affected models; organizations and consumers should patch exposed routers, replace unsupported hardware, and disable unnecessary remote-access services.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
The Dutch NCSC published incident-response findings showing Alogin and a new TheMoon variant coexisting on an internet-exposed ASUS RT-AC66U router. It identified roughly 150 likely compromised SOHO routers in the Netherlands and estimated the associated botnets comprised about 13,000 systems globally.
Following responsible disclosure, ASUS released firmware updates for supported affected router models. NCSC advised users to patch promptly or replace unsupported routers.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported multiple campaigns compromising internet-facing edge devices, with **ASUS routers** and **Cisco Small Business/SOHO routers** heavily targeted to build stealthy botnets and relay infrastructure. GreyNoise and Censys tracked the **AyySSHush** campaign abusing legitimate ASUS firmware features, older authentication bypass paths, and `CVE-2023-39780` to enable logging functions, add attacker SSH keys, and expose backdoor access on **TCP/53282**; Censys identified **4,504 likely compromised ASUS devices** as of late May, after counts had previously surged above **10,000**. Sekoia separately observed a May campaign against ASUS routers using `CVE-2021-32030` to enable SSH on the same port, with more than **9,500 potentially affected devices**. At the same time, Sekoia detailed **PolarEdge** and **ViciousTrap**, campaigns exploiting `CVE-2023-20118` in Cisco routers and extending to devices from **QNAP, Synology, and ASUS**. PolarEdge used webshells and encrypted TLS backdoors to create an **Operational Relay Box** network of more than **2,000 devices**, while ViciousTrap installed NAT redirection rules to turn compromised systems into a distributed interception layer that forwarded inbound traffic to attacker-controlled servers; Sekoia counted **over 5,000 compromised devices** across many countries. Investigators also found overlap between the ASUS activity and infrastructure tied to ViciousTrap, suggesting at least some operators are reusing tooling and access across edge-device botnet operations, with residential ISP exposure indicating likely use for proxying, relays, or follow-on cyber activity.
Aug 15, 2026
GreyNoise reported that a stealthy campaign dubbed **AyySSHush** compromised more than 9,000 internet-exposed Asus routers by exploiting authentication weaknesses and `CVE-2023-39780`, then establishing persistence without deploying conventional malware. The attackers enabled SSH on TCP port `53282`, inserted their own public key for remote access, and stored the configuration in NVRAM so the backdoor survives reboots and standard firmware upgrades. Researchers said the operation was unusually quiet and targeted, with GreyNoise observing only a few dozen malicious HTTP POST requests over several months, while the attackers also disabled logging and Asus **AiProtection** to reduce the chance of detection. Asus released firmware updates to address the documented vulnerability and undocumented login bypasses, but devices already compromised require manual cleanup or a full factory reset because upgrading firmware alone does not remove the implanted SSH access. The incident echoes earlier large-scale router compromises such as **VPNFilter**, the sophisticated botnet that infected hundreds of thousands of routers and NAS devices, used modular malware, and raised fears of disruptive operations tied to Ukraine; together, the cases underscore how edge devices can be quietly converted into durable footholds for botnet activity and potential follow-on attacks.
Jun 29, 2026
The **TheMoon** malware spread across multiple Linksys router models by exploiting an unauthenticated remote code execution flaw exposed through the HNAP interface and CGI endpoints including `tmUnblock.cgi` and `hndUnblock.cgi` on port `8080`. Researchers reported that the worm queried `/HNAP1/` to identify device model and firmware, then triggered command injection to launch a shell script that fetched a roughly 2 MB MIPS ELF payload. Public exploit code later showed how the flaw could write a payload to `/tmp/c0d3z`, mark it executable, and run it to open a bind shell on TCP port `4444`, confirming the practicality of the attack path used against vulnerable routers.
Aug 15, 2026