Uk households issued wifi warning after top-brand routers hacked in attack

ANALYSTS WHO UNCOVERED THE HACK SAID IT HAS ALREADY IMPACTED OVER 9,000 DEVICES AND IS STILL ONGOING. 15:30, 30 May 2025 An urgent Wi-Fi warning has been issued after THOUSANDS of top-brand

routers were hacked in a mystery attack. Analysts who uncovered the hack said it has already impacted over 9,000 devices and is still ongoing. Routers are being added to a 'botnet

army', with experts urging users to perform a factory reset. At the time of publication, only Asus routers have been hit. Hackers are breaching routers through brute-force login

attempts and authentication bypasses that rely on a command injection vulnerability, tracked as CVE-2023-39780, to execute system commands, GreyNoise researchers said in a blog post on

Wednesday. READ MORE LLOYDS BANK BRINGS IN BIG CHANGE AND ANYONE WHO IS IN A 'COUPLE' WILL BENEFIT A GreyNoise report on the hack said: "The techniques used reflect long-term

access planning and a high level of system knowledge." Article continues below GreyNoise first detected suspicious activity in March, when it flagged three suspicious HTTP POST requests

made to ASUS routers, according to Matthew Remacle, senior researcher at GreyNoise. ASUS has issued a firmware update that includes a patch addressing the recently discovered vulnerability.

However, according to cybersecurity firm GreyNoise, initial attempts to bypass this patch have yet to be assigned CVE identifiers. Researchers warn that if a router was compromised prior to

applying the update, a persistent backdoor could remain on the device unless Secure Shell (SSH) access is explicitly disabled. GreyNoise’s estimation of the number of affected devices is

derived from data collected through Censys scans. Article continues below While the hacking campaign has not been definitively linked to any specific group, the techniques employed are

consistent with those typically used by advanced persistent threat (APT) actors. Notably, the attackers maintain control over infected devices even after they are rebooted or undergo

firmware upgrades. GreyNoise also revealed that government officials and industry stakeholders requested a temporary delay in the public disclosure of the vulnerability. This pause was

intended to allow time for coordinated efforts to address the security flaws and implement effective fixes.