Symfony Profiler

{
    "@context": [
        "https:\/\/join-lemmy.org\/context.json",
        "https:\/\/www.w3.org\/ns\/activitystreams"
    ],
    "actor": "https:\/\/lemmy.ml\/c\/privacy",
    "to": [
        "https:\/\/www.w3.org\/ns\/activitystreams#Public"
    ],
    "object": {
        "id": "https:\/\/hexbear.net\/activities\/create\/cab754df-fcaa-41a0-bb75-0cc9eed15c45",
        "actor": "https:\/\/hexbear.net\/u\/stupid_asshole69",
        "@context": [
            "https:\/\/join-lemmy.org\/context.json",
            "https:\/\/www.w3.org\/ns\/activitystreams"
        ],
        "to": [
            "https:\/\/www.w3.org\/ns\/activitystreams#Public"
        ],
        "object": {
            "type": "Note",
            "id": "https:\/\/hexbear.net\/comment\/6202373",
            "attributedTo": "https:\/\/hexbear.net\/u\/stupid_asshole69",
            "to": [
                "https:\/\/www.w3.org\/ns\/activitystreams#Public"
            ],
            "cc": [
                "https:\/\/lemmy.ml\/c\/privacy",
                "https:\/\/lemm.ee\/u\/schizoidman"
            ],
            "content": "<p>The source the article is based on:<\/p>\n<details><summary>spoiler<\/summary><p>___\nGreyNoise has identified an ongoing exploitation campaign in which attackers have gained unauthorized, persistent access to thousands of ASUS routers exposed to the internet. This appears to be part of a stealth operation to assemble a distributed network of backdoor devices \u2014 potentially laying the groundwork for a future botnet.\nThe tactics used in this campaign \u2014 stealthy initial access, use of built-in system features for persistence, and careful avoidance of detection \u2014 are consistent with those seen in advanced, long-term operations, including activity associated with advanced persistent threat (APT) actors and operational relay box (ORB) networks. While GreyNoise has made no attribution, the level of tradecraft suggests a well-resourced and highly capable adversary.\n\u200dThe attacker\u2019s access survives both reboots and firmware updates, giving them durable control over affected devices. The attacker maintains long-term access without dropping malware or leaving obvious traces by chaining authentication bypasses, exploiting a known vulnerability, and abusing legitimate configuration features.\n\u200dThe activity was uncovered by Sift \u2014 GreyNoise\u2019s proprietary AI-powered network payload analysis tool \u2014 in combination with fully emulated ASUS router profiles running in the GreyNoise Global Observation Grid. These tools enabled us to detect subtle exploitation attempts buried in global traffic and reconstruct the full attack sequence.\n\u200dRead the full technical analysis.\n\u200d\nTimeline of Events\nMarch 17, 2025: GreyNoise\u2019s proprietary AI technology, Sift, observes anomalous traffic.<br \/>\nMarch 18, 2025: GreyNoise researchers become aware of Sift report and begin investigating.\nMarch 23, 2025: Disclosure deferred as we coordinated the findings with government and industry partners.<br \/>\nMay 22, 2025: Sekoia announces compromise of ASUS routers as part of \u2018ViciousTrap.\u2019\nMay 28, 2025: GreyNoise publishes this blog.\n\u200d\nSummary of Findings\nThousands of ASUS routers are confirmed compromised, with the number steadily increasing.\nAttackers gain access using brute-force login attempts and authentication bypasses, including techniques not assigned CVEs.\nAttackers exploit CVE-2023-39780, a command injection flaw, to execute system commands.\nThey use legitimate ASUS features to:\nEnable SSH access on a custom port (TCP\/53282).\nInsert attacker-controlled public key for remote access.\nThe backdoor is stored in non-volatile memory (NVRAM) and is therefore not removed during firmware upgrades or reboots.\nNo malware is installed, and router logging is disabled to evade detection.\nThe techniques used reflect long-term access planning and a high level of system knowledge.\n\u200d\nHow GreyNoise Found It\nThe campaign was surfaced by Sift, GreyNoise\u2019s AI-powered analysis tool for detecting novel and anomalous network activity. Sift flagged just three HTTP POST requests \u2014 targeting ASUS router endpoints \u2014 for deeper inspection.\nThese payloads were only observed on our fully emulated ASUS profiles running factory firmware. This infrastructure allowed GreyNoise to:\nCapture full PCAP of the requests and router behavior.\nReproduce the attack in a controlled environment.\nConfirm how the backdoor is installed and how it persists.<br \/>\nWithout emulated profiles and deep inspection, this attack would likely have remained invisible. The attacker disables logging and uses official router features, leaving few traces.\n\u200d\nConfirmed Exploitation Chain\n1. Initial Access\nBrute-force login attempts.\nTwo authentication bypass techniques (no CVEs assigned).\n\u200d\n2. Command Execution\nExploitation of CVE-2023-39780 to run arbitrary commands.\n\u200d\n3. Persistence\nSSH access is enabled via official ASUS settings.\nAttacker inserts a custom public SSH key.\nConfiguration is stored in NVRAM, not on disk.\n\u200d\n4. Stealth\nLogging is disabled before persistence is established.\nNo malware is left behind.\n\u200d\nScope and Visibility\nAs of May 27, nearly 9,000 ASUS routers are confirmed compromised, based on scans from Censys \u2014 a platform that continuously maps and monitors internet-facing assets across the global internet. Censys reveals what\u2019s exposed; GreyNoise shows which of those assets are being actively targeted.\nThe number of affected hosts is growing.\nGreyNoise sensors saw just 30 related requests across three months, demonstrating how quietly this campaign is operating.\n\u200d\nIndicators of Compromise\n\u200d\nIP addresses involved in this activity:\n101.99.91.151\n101.99.94.173\n79.141.163.179<br \/>\n111.90.146.237\nCOPY\n\u200d\nBLOCK MALICIOUS IPS\n\u200d\nBackdoor port:\nTCP\/53282\nCOPY\n\u200d\nAttacker SSH public key (truncated):\nssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAo41nBoVFfj4HlVMGV+YPsxMDrMlbdDZ\u2026\nCOPY\n\u200d\nHas ASUS Released a Patch?\nASUS patched CVE-2023-39780 in a recent firmware update.\nThe initial login bypass techniques are patched but do not have assigned CVEs.\nThe attacker\u2019s SSH configuration changes are not removed by firmware upgrades.\nIf a router was compromised before updating, the backdoor will still be present unless SSH access is explicitly reviewed and removed.\n\u200d\nRecommendations\nCheck ASUS routers for SSH access on TCP\/53282.\nReview the authorized_keys file for unauthorized entries.\nBlock the four IPs listed above.\nIf compromise is suspected, perform a full factory reset and reconfigure manually.\n\u200d\nBlock IPs &amp; Read the Full Analysis\nFor payload details, firmware analysis, and attack reconstruction:\nRead the full technical analysis.\n\u200d\nBLOCK MALICIOUS IPS\n\u200d\n\u200d\n\u200dGreyNoise is developing an enhanced dynamic IP blocklist to help defenders take faster action on emerging threats. Click here to learn more or get on the waitlist.\nThis article is a summary of the full, in-depth version on the GreyNoise Labs blog.\nRead the full report\n<\/p><\/details>\n",
            "inReplyTo": "https:\/\/lemm.ee\/post\/65299660",
            "mediaType": "text\/html",
            "source": {
                "content": "The source the article is based on:\n::: spoiler spoiler\n___\n\nGreyNoise has identified an ongoing exploitation campaign in which attackers have gained unauthorized, persistent access to thousands of ASUS routers exposed to the internet. This appears to be part of a stealth operation to assemble a distributed network of backdoor devices \u2014 potentially laying the groundwork for a future botnet. \n\nThe tactics used in this campaign \u2014 stealthy initial access, use of built-in system features for persistence, and careful avoidance of detection \u2014 are consistent with those seen in advanced, long-term operations, including activity associated with advanced persistent threat (APT) actors and operational relay box (ORB) networks. While GreyNoise has made no attribution, the level of tradecraft suggests a well-resourced and highly capable adversary. \n\n\u200dThe attacker\u2019s access survives both reboots and firmware updates, giving them durable control over affected devices. The attacker maintains long-term access without dropping malware or leaving obvious traces by chaining authentication bypasses, exploiting a known vulnerability, and abusing legitimate configuration features. \n\n\u200dThe activity was uncovered by Sift \u2014 GreyNoise\u2019s proprietary AI-powered network payload analysis tool \u2014 in combination with fully emulated ASUS router profiles running in the GreyNoise Global Observation Grid. These tools enabled us to detect subtle exploitation attempts buried in global traffic and reconstruct the full attack sequence. \n\n\u200dRead the full technical analysis. \n\n\u200d\n\nTimeline of Events\n\nMarch 17, 2025: GreyNoise\u2019s proprietary AI technology, Sift, observes anomalous traffic.  \n\nMarch 18, 2025: GreyNoise researchers become aware of Sift report and begin investigating.\n\nMarch 23, 2025: Disclosure deferred as we coordinated the findings with government and industry partners.   \n\nMay 22, 2025: Sekoia announces compromise of ASUS routers as part of \u2018ViciousTrap.\u2019\n\nMay 28, 2025: GreyNoise publishes this blog. \n\n\u200d\n\nSummary of Findings\n\nThousands of ASUS routers are confirmed compromised, with the number steadily increasing. \nAttackers gain access using brute-force login attempts and authentication bypasses, including techniques not assigned CVEs. \nAttackers exploit CVE-2023-39780, a command injection flaw, to execute system commands.\nThey use legitimate ASUS features to: \nEnable SSH access on a custom port (TCP\/53282).\nInsert attacker-controlled public key for remote access.\nThe backdoor is stored in non-volatile memory (NVRAM) and is therefore not removed during firmware upgrades or reboots. \nNo malware is installed, and router logging is disabled to evade detection. \nThe techniques used reflect long-term access planning and a high level of system knowledge. \n\u200d\n\nHow GreyNoise Found It\n\nThe campaign was surfaced by Sift, GreyNoise\u2019s AI-powered analysis tool for detecting novel and anomalous network activity. Sift flagged just three HTTP POST requests \u2014 targeting ASUS router endpoints \u2014 for deeper inspection. \n\nThese payloads were only observed on our fully emulated ASUS profiles running factory firmware. This infrastructure allowed GreyNoise to:\n\nCapture full PCAP of the requests and router behavior. \nReproduce the attack in a controlled environment.\nConfirm how the backdoor is installed and how it persists.  \nWithout emulated profiles and deep inspection, this attack would likely have remained invisible. The attacker disables logging and uses official router features, leaving few traces. \n\n\u200d\n\nConfirmed Exploitation Chain\n\n1. Initial Access\n\nBrute-force login attempts. \nTwo authentication bypass techniques (no CVEs assigned).\n\u200d\n\n2. Command Execution \n\nExploitation of CVE-2023-39780 to run arbitrary commands.\n\u200d\n\n3. Persistence \n\nSSH access is enabled via official ASUS settings.\nAttacker inserts a custom public SSH key.\nConfiguration is stored in NVRAM, not on disk.\n\u200d\n\n4. Stealth\n\nLogging is disabled before persistence is established. \nNo malware is left behind.\n\u200d\n\nScope and Visibility \n\nAs of May 27, nearly 9,000 ASUS routers are confirmed compromised, based on scans from Censys \u2014 a platform that continuously maps and monitors internet-facing assets across the global internet. Censys reveals what\u2019s exposed; GreyNoise shows which of those assets are being actively targeted. \nThe number of affected hosts is growing. \nGreyNoise sensors saw just 30 related requests across three months, demonstrating how quietly this campaign is operating. \n\u200d\n\nIndicators of Compromise\n\n\u200d\n\nIP addresses involved in this activity: \n\n101.99.91.151\n101.99.94.173 \n79.141.163.179   \n111.90.146.237\nCOPY\n\u200d\n\nBLOCK MALICIOUS IPS\n\u200d\n\nBackdoor port: \n\nTCP\/53282\nCOPY\n\u200d\n\nAttacker SSH public key (truncated):\n\nssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAo41nBoVFfj4HlVMGV+YPsxMDrMlbdDZ... \nCOPY\n\u200d\n\nHas ASUS Released a Patch?\n\nASUS patched CVE-2023-39780 in a recent firmware update. \nThe initial login bypass techniques are patched but do not have assigned CVEs.\nThe attacker\u2019s SSH configuration changes are not removed by firmware upgrades. \nIf a router was compromised before updating, the backdoor will still be present unless SSH access is explicitly reviewed and removed. \n\n\u200d\n\nRecommendations \n\nCheck ASUS routers for SSH access on TCP\/53282. \nReview the authorized_keys file for unauthorized entries.\nBlock the four IPs listed above.\nIf compromise is suspected, perform a full factory reset and reconfigure manually.\n\u200d\n\nBlock IPs & Read the Full Analysis\n\nFor payload details, firmware analysis, and attack reconstruction: \n\nRead the full technical analysis.\n\n\u200d\n\nBLOCK MALICIOUS IPS\n\u200d\n\n\u200d\n\n\u200dGreyNoise is developing an enhanced dynamic IP blocklist to help defenders take faster action on emerging threats. Click here to learn more or get on the waitlist.\n\nThis article is a summary of the full, in-depth version on the GreyNoise Labs blog.\nRead the full report\n\n:::\n",
                "mediaType": "text\/markdown"
            },
            "published": "2025-06-01T20:23:11.793549Z",
            "tag": [
                {
                    "href": "https:\/\/lemm.ee\/u\/schizoidman",
                    "name": "@schizoidman@lemm.ee",
                    "type": "Mention"
                }
            ],
            "distinguished": false,
            "language": {
                "identifier": "en",
                "name": "English"
            },
            "audience": "https:\/\/lemmy.ml\/c\/privacy",
            "attachment": []
        },
        "cc": [
            "https:\/\/lemmy.ml\/c\/privacy",
            "https:\/\/lemm.ee\/u\/schizoidman"
        ],
        "tag": [
            {
                "href": "https:\/\/lemm.ee\/u\/schizoidman",
                "name": "@schizoidman@lemm.ee",
                "type": "Mention"
            }
        ],
        "type": "Create",
        "audience": "https:\/\/lemmy.ml\/c\/privacy"
    },
    "cc": [
        "https:\/\/lemmy.ml\/c\/privacy\/followers"
    ],
    "type": "Announce",
    "id": "https:\/\/lemmy.ml\/activities\/announce\/create\/9f7769aa-74e9-4cb4-9990-da3bedf5e9d7"
}

{"@context":["https://join-lemmy.org/context.json","https://www.w3.org/ns/activitystreams"],"actor":"https://lemmy.ml/c/privacy","to":["https://www.w3.org/ns/activitystreams#Public"],"object":{"id":"https://hexbear.net/activities/create/cab754df-fcaa-41a0-bb75-0cc9eed15c45","actor":"https://hexbear.net/u/stupid_asshole69","@context":["https://join-lemmy.org/context.json","https://www.w3.org/ns/activitystreams"],"to":["https://www.w3.org/ns/activitystreams#Public"],"object":{"type":"Note","id":"https://hexbear.net/comment/6202373","attributedTo":"https://hexbear.net/u/stupid_asshole69","to":["https://www.w3.org/ns/activitystreams#Public"],"cc":["https://lemmy.ml/c/privacy","https://lemm.ee/u/schizoidman"],"content":"<p>The source the article is based on:</p>\n<details><summary>spoiler</summary><p>___\nGreyNoise has identified an ongoing exploitation campaign in which attackers have gained unauthorized, persistent access to thousands of ASUS routers exposed to the internet. This appears to be part of a stealth operation to assemble a distributed network of backdoor devices — potentially laying the groundwork for a future botnet.\nThe tactics used in this campaign — stealthy initial access, use of built-in system features for persistence, and careful avoidance of detection — are consistent with those seen in advanced, long-term operations, including activity associated with advanced persistent threat (APT) actors and operational relay box (ORB) networks. While GreyNoise has made no attribution, the level of tradecraft suggests a well-resourced and highly capable adversary.\n‍The attacker’s access survives both reboots and firmware updates, giving them durable control over affected devices. The attacker maintains long-term access without dropping malware or leaving obvious traces by chaining authentication bypasses, exploiting a known vulnerability, and abusing legitimate configuration features.\n‍The activity was uncovered by Sift — GreyNoise’s proprietary AI-powered network payload analysis tool — in combination with fully emulated ASUS router profiles running in the GreyNoise Global Observation Grid. These tools enabled us to detect subtle exploitation attempts buried in global traffic and reconstruct the full attack sequence.\n‍Read the full technical analysis.\n‍\nTimeline of Events\nMarch 17, 2025: GreyNoise’s proprietary AI technology, Sift, observes anomalous traffic.<br />\nMarch 18, 2025: GreyNoise researchers become aware of Sift report and begin investigating.\nMarch 23, 2025: Disclosure deferred as we coordinated the findings with government and industry partners.<br />\nMay 22, 2025: Sekoia announces compromise of ASUS routers as part of ‘ViciousTrap.’\nMay 28, 2025: GreyNoise publishes this blog.\n‍\nSummary of Findings\nThousands of ASUS routers are confirmed compromised, with the number steadily increasing.\nAttackers gain access using brute-force login attempts and authentication bypasses, including techniques not assigned CVEs.\nAttackers exploit CVE-2023-39780, a command injection flaw, to execute system commands.\nThey use legitimate ASUS features to:\nEnable SSH access on a custom port (TCP/53282).\nInsert attacker-controlled public key for remote access.\nThe backdoor is stored in non-volatile memory (NVRAM) and is therefore not removed during firmware upgrades or reboots.\nNo malware is installed, and router logging is disabled to evade detection.\nThe techniques used reflect long-term access planning and a high level of system knowledge.\n‍\nHow GreyNoise Found It\nThe campaign was surfaced by Sift, GreyNoise’s AI-powered analysis tool for detecting novel and anomalous network activity. Sift flagged just three HTTP POST requests — targeting ASUS router endpoints — for deeper inspection.\nThese payloads were only observed on our fully emulated ASUS profiles running factory firmware. This infrastructure allowed GreyNoise to:\nCapture full PCAP of the requests and router behavior.\nReproduce the attack in a controlled environment.\nConfirm how the backdoor is installed and how it persists.<br />\nWithout emulated profiles and deep inspection, this attack would likely have remained invisible. The attacker disables logging and uses official router features, leaving few traces.\n‍\nConfirmed Exploitation Chain\n1. Initial Access\nBrute-force login attempts.\nTwo authentication bypass techniques (no CVEs assigned).\n‍\n2. Command Execution\nExploitation of CVE-2023-39780 to run arbitrary commands.\n‍\n3. Persistence\nSSH access is enabled via official ASUS settings.\nAttacker inserts a custom public SSH key.\nConfiguration is stored in NVRAM, not on disk.\n‍\n4. Stealth\nLogging is disabled before persistence is established.\nNo malware is left behind.\n‍\nScope and Visibility\nAs of May 27, nearly 9,000 ASUS routers are confirmed compromised, based on scans from Censys — a platform that continuously maps and monitors internet-facing assets across the global internet. Censys reveals what’s exposed; GreyNoise shows which of those assets are being actively targeted.\nThe number of affected hosts is growing.\nGreyNoise sensors saw just 30 related requests across three months, demonstrating how quietly this campaign is operating.\n‍\nIndicators of Compromise\n‍\nIP addresses involved in this activity:\n101.99.91.151\n101.99.94.173\n79.141.163.179<br />\n111.90.146.237\nCOPY\n‍\nBLOCK MALICIOUS IPS\n‍\nBackdoor port:\nTCP/53282\nCOPY\n‍\nAttacker SSH public key (truncated):\nssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAo41nBoVFfj4HlVMGV+YPsxMDrMlbdDZ…\nCOPY\n‍\nHas ASUS Released a Patch?\nASUS patched CVE-2023-39780 in a recent firmware update.\nThe initial login bypass techniques are patched but do not have assigned CVEs.\nThe attacker’s SSH configuration changes are not removed by firmware upgrades.\nIf a router was compromised before updating, the backdoor will still be present unless SSH access is explicitly reviewed and removed.\n‍\nRecommendations\nCheck ASUS routers for SSH access on TCP/53282.\nReview the authorized_keys file for unauthorized entries.\nBlock the four IPs listed above.\nIf compromise is suspected, perform a full factory reset and reconfigure manually.\n‍\nBlock IPs &amp; Read the Full Analysis\nFor payload details, firmware analysis, and attack reconstruction:\nRead the full technical analysis.\n‍\nBLOCK MALICIOUS IPS\n‍\n‍\n‍GreyNoise is developing an enhanced dynamic IP blocklist to help defenders take faster action on emerging threats. Click here to learn more or get on the waitlist.\nThis article is a summary of the full, in-depth version on the GreyNoise Labs blog.\nRead the full report\n</p></details>\n","inReplyTo":"https://lemm.ee/post/65299660","mediaType":"text/html","source":{"content":"The source the article is based on:\n::: spoiler spoiler\n___\n\nGreyNoise has identified an ongoing exploitation campaign in which attackers have gained unauthorized, persistent access to thousands of ASUS routers exposed to the internet. This appears to be part of a stealth operation to assemble a distributed network of backdoor devices — potentially laying the groundwork for a future botnet. \n\nThe tactics used in this campaign — stealthy initial access, use of built-in system features for persistence, and careful avoidance of detection — are consistent with those seen in advanced, long-term operations, including activity associated with advanced persistent threat (APT) actors and operational relay box (ORB) networks. While GreyNoise has made no attribution, the level of tradecraft suggests a well-resourced and highly capable adversary. \n\n‍The attacker’s access survives both reboots and firmware updates, giving them durable control over affected devices. The attacker maintains long-term access without dropping malware or leaving obvious traces by chaining authentication bypasses, exploiting a known vulnerability, and abusing legitimate configuration features. \n\n‍The activity was uncovered by Sift — GreyNoise’s proprietary AI-powered network payload analysis tool — in combination with fully emulated ASUS router profiles running in the GreyNoise Global Observation Grid. These tools enabled us to detect subtle exploitation attempts buried in global traffic and reconstruct the full attack sequence. \n\n‍Read the full technical analysis. \n\n‍\n\nTimeline of Events\n\nMarch 17, 2025: GreyNoise’s proprietary AI technology, Sift, observes anomalous traffic.  \n\nMarch 18, 2025: GreyNoise researchers become aware of Sift report and begin investigating.\n\nMarch 23, 2025: Disclosure deferred as we coordinated the findings with government and industry partners.   \n\nMay 22, 2025: Sekoia announces compromise of ASUS routers as part of ‘ViciousTrap.’\n\nMay 28, 2025: GreyNoise publishes this blog. \n\n‍\n\nSummary of Findings\n\nThousands of ASUS routers are confirmed compromised, with the number steadily increasing. \nAttackers gain access using brute-force login attempts and authentication bypasses, including techniques not assigned CVEs. \nAttackers exploit CVE-2023-39780, a command injection flaw, to execute system commands.\nThey use legitimate ASUS features to: \nEnable SSH access on a custom port (TCP/53282).\nInsert attacker-controlled public key for remote access.\nThe backdoor is stored in non-volatile memory (NVRAM) and is therefore not removed during firmware upgrades or reboots. \nNo malware is installed, and router logging is disabled to evade detection. \nThe techniques used reflect long-term access planning and a high level of system knowledge. \n‍\n\nHow GreyNoise Found It\n\nThe campaign was surfaced by Sift, GreyNoise’s AI-powered analysis tool for detecting novel and anomalous network activity. Sift flagged just three HTTP POST requests — targeting ASUS router endpoints — for deeper inspection. \n\nThese payloads were only observed on our fully emulated ASUS profiles running factory firmware. This infrastructure allowed GreyNoise to:\n\nCapture full PCAP of the requests and router behavior. \nReproduce the attack in a controlled environment.\nConfirm how the backdoor is installed and how it persists.  \nWithout emulated profiles and deep inspection, this attack would likely have remained invisible. The attacker disables logging and uses official router features, leaving few traces. \n\n‍\n\nConfirmed Exploitation Chain\n\n1. Initial Access\n\nBrute-force login attempts. \nTwo authentication bypass techniques (no CVEs assigned).\n‍\n\n2. Command Execution \n\nExploitation of CVE-2023-39780 to run arbitrary commands.\n‍\n\n3. Persistence \n\nSSH access is enabled via official ASUS settings.\nAttacker inserts a custom public SSH key.\nConfiguration is stored in NVRAM, not on disk.\n‍\n\n4. Stealth\n\nLogging is disabled before persistence is established. \nNo malware is left behind.\n‍\n\nScope and Visibility \n\nAs of May 27, nearly 9,000 ASUS routers are confirmed compromised, based on scans from Censys — a platform that continuously maps and monitors internet-facing assets across the global internet. Censys reveals what’s exposed; GreyNoise shows which of those assets are being actively targeted. \nThe number of affected hosts is growing. \nGreyNoise sensors saw just 30 related requests across three months, demonstrating how quietly this campaign is operating. \n‍\n\nIndicators of Compromise\n\n‍\n\nIP addresses involved in this activity: \n\n101.99.91.151\n101.99.94.173 \n79.141.163.179   \n111.90.146.237\nCOPY\n‍\n\nBLOCK MALICIOUS IPS\n‍\n\nBackdoor port: \n\nTCP/53282\nCOPY\n‍\n\nAttacker SSH public key (truncated):\n\nssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAo41nBoVFfj4HlVMGV+YPsxMDrMlbdDZ... \nCOPY\n‍\n\nHas ASUS Released a Patch?\n\nASUS patched CVE-2023-39780 in a recent firmware update. \nThe initial login bypass techniques are patched but do not have assigned CVEs.\nThe attacker’s SSH configuration changes are not removed by firmware upgrades. \nIf a router was compromised before updating, the backdoor will still be present unless SSH access is explicitly reviewed and removed. \n\n‍\n\nRecommendations \n\nCheck ASUS routers for SSH access on TCP/53282. \nReview the authorized_keys file for unauthorized entries.\nBlock the four IPs listed above.\nIf compromise is suspected, perform a full factory reset and reconfigure manually.\n‍\n\nBlock IPs & Read the Full Analysis\n\nFor payload details, firmware analysis, and attack reconstruction: \n\nRead the full technical analysis.\n\n‍\n\nBLOCK MALICIOUS IPS\n‍\n\n‍\n\n‍GreyNoise is developing an enhanced dynamic IP blocklist to help defenders take faster action on emerging threats. Click here to learn more or get on the waitlist.\n\nThis article is a summary of the full, in-depth version on the GreyNoise Labs blog.\nRead the full report\n\n:::\n","mediaType":"text/markdown"},"published":"2025-06-01T20:23:11.793549Z","tag":[{"href":"https://lemm.ee/u/schizoidman","name":"@schizoidman@lemm.ee","type":"Mention"}],"distinguished":false,"language":{"identifier":"en","name":"English"},"audience":"https://lemmy.ml/c/privacy","attachment":[]},"cc":["https://lemmy.ml/c/privacy","https://lemm.ee/u/schizoidman"],"tag":[{"href":"https://lemm.ee/u/schizoidman","name":"@schizoidman@lemm.ee","type":"Mention"}],"type":"Create","audience":"https://lemmy.ml/c/privacy"},"cc":["https://lemmy.ml/c/privacy/followers"],"type":"Announce","id":"https://lemmy.ml/activities/announce/create/9f7769aa-74e9-4cb4-9990-da3bedf5e9d7"}