Thousands of Asus routers compromised by "ViciousTrap" backdoor

The big picture: Backdoors are typically designed to bypass traditional authentication methods and provide unauthorized remote access to vulnerable network appliances or endpoint devices. The most effective backdoors remain invisible to both end users and system administrators, making them especially attractive to threat actors engaged in covert cyber-espionage campaigns. Analysts at GreyNoise have uncovered a mysterious backdoor-based campaign affecting more than 9,000 Asus routers. The unknown cybercriminals are exploiting security vulnerabilities – some of which have already been patched – while others have never been assigned proper tracking entries in the CVE database. The story is full of "unknowns," as the attackers have yet to take visible action with the sizeable botnet they have built. The backdoor, now tracked as "ViciousTrap," was first identified by GreyNoise's proprietary AI system, Sift. The AI detected anomalous traffic in March, prompting researchers to investigate t ... Read full article.