Operation WrtHug shows how router EoL flaws enable espionage

At a glance

What this is: SecurityScorecard says Operation WrtHug turned thousands of ASUS routers into a global espionage network by exploiting publicly known flaws in end-of-life devices.

Why it matters: Network defence teams need to treat ageing edge equipment as an identity and access problem as well as a patching problem, because compromised routers can provide persistent, hard-to-see infrastructure for espionage.

By the numbers:

• The campaign used a shared, self-signed TLS certificate with an unusually long 100-year expiration period.
• CVE-2023-39780 is rated 8.8 on the CVSS severity scale, while CVE-2025-2492 carries a 9.2 score.

Context

Operation WrtHug is a network-edge compromise story, not just a router patching story. The report describes attackers exploiting publicly known vulnerabilities in ASUS routers, especially end-of-life devices and exposed remote-access services, to build a covert infrastructure layer that can persist after ordinary remediation cycles. The security problem is that unmanaged edge devices often sit outside mature asset, patch, and monitoring processes, which makes them a durable foothold rather than a disposable appliance.

For identity and access practitioners, the relevant lesson is that devices and embedded services can function like non-human identities when they expose stable authentication surfaces, certificates, and remote management paths. Once those surfaces are abused, the device becomes a trusted relay point rather than an isolated endpoint. That makes lifecycle control, inventory accuracy, and certificate monitoring as important on the network edge as they are for traditional service accounts or workloads.

Key questions

Q: What breaks when internet-facing routers are left on unsupported firmware?

A: Unsupported routers become long-lived footholds because attackers can exploit known flaws after defenders have stopped actively maintaining the device. The break is not only technical. It is governance failure. Once the appliance is end-of-life, patching no longer closes the risk, so organisations must isolate, replace, or remove the device before it becomes relay infrastructure.

Q: Why do vulnerable edge devices create persistent espionage risk?

A: Because attackers can reuse the same exposed management path across many devices and keep a trusted network position even after the original exploit is understood. The risk is not just initial compromise but sustained access through infrastructure that defenders rarely watch as closely as endpoints or servers.

Q: What are the signs that router compromise is being used for relay activity?

A: Look for unusual self-signed certificates, repeated service fingerprints across distant IP addresses, unexpected remote-access exposure, and devices that continue to communicate normally while behaving as shared infrastructure. Those signals suggest a campaign that is trying to stay hidden inside ordinary network traffic.

Q: How should network teams decide whether to replace or contain ageing routers?

A: If a device is end-of-life, still internet-exposed, or carrying services that cannot be tightly governed, replacement is usually the safer decision. Containment can buy time, but it should be temporary and backed by segmentation, monitoring, and a removal plan.

Technical breakdown

How end-of-life routers become persistent footholds

End-of-life routers are attractive because they often retain exposed services, unpatched firmware, and weak operational oversight after the vendor support window closes. In this campaign, the attackers targeted ASUS WRT routers through multiple public vulnerabilities and AiCloud, which is a remote-access service that widens the attack surface beyond basic web administration. Once compromised, the device can remain embedded in the network as an accessible relay or staging point, especially if administrators no longer monitor it closely. The technical issue is not only the exploit itself, but the combination of stale software, internet exposure, and poor device lifecycle governance.

Practical implication: Treat EoL network devices as active risk assets and remove or isolate them before they become persistent footholds.

Why command injection and authentication flaws scale across fleets

Command injection lets an attacker execute system commands through an exposed interface, which is especially dangerous on routers because those devices typically run with broad local authority. The report cites several ASUS vulnerabilities, including OS command injection issues and improper authentication, showing how attackers can chain flaws to reach higher privilege levels and broader device control. When the same weakness exists across many deployed units, exploitation scales quickly because each vulnerable device presents the same reachable code path. That makes the problem one of fleet exposure, not a single-device defect.

Practical implication: Map exposed router services and firmware versions to known exploit paths, then prioritise broad fleet containment over per-device troubleshooting.

What the 100-year certificate reveals about campaign tracking

A self-signed TLS certificate with a 100-year expiration period is unusual enough to become a durable campaign fingerprint. In operations like this, attackers use certificates, host patterns, or service artefacts that survive device compromise and help defenders correlate infected nodes across geographies. The value for defenders is that operational telemetry can expose a campaign even when the underlying exploit chain changes. That matters because espionage infrastructure is often designed to blend into legitimate traffic, so defenders need indicators that survive across multiple infection stages.

Practical implication: Add certificate and service-fingerprint monitoring to edge-device detections so you can correlate compromised infrastructure across regions.

Threat narrative

Attacker objective: The attackers appear to have been building persistent relay infrastructure for long-term espionage, not simply defacing or briefly disrupting routers.

1. Entry occurred when attackers used AiCloud and other publicly known ASUS vulnerabilities to reach exposed routers and execute commands remotely.
2. Credential and authentication abuse followed as the attackers combined command injection and improper authentication weaknesses to gain high-level privileges on the devices.
3. Impact came when compromised routers were absorbed into a global espionage network that could support persistent relay and relay-box operations.

NHI Mgmt Group analysis

Edge-device lifecycle failure is the core governance gap here: the campaign succeeds because organisations often treat routers as infrastructure, not as governed security assets with a lifecycle. Once a device reaches end of life, exposed services and stale firmware become a long-tail access problem rather than a routine patching issue. Practitioners should treat unsupported edge gear as a governance exception, not a background maintenance item.

Persistent espionage infrastructure changes how defenders should think about network trust: a compromised router can act like a non-human foothold that survives longer than many endpoint controls are designed to track. That means network security teams need asset inventories, certificate monitoring, and service exposure control to converge, rather than operating as separate disciplines. The practical conclusion is that trust at the edge must be continuously revalidated.

Certificate fingerprinting is a valuable but insufficient control: the 100-year self-signed TLS certificate is a strong detection clue, but it is only one artefact in a broader campaign pattern. The deeper issue is that attackers can swap infrastructure while preserving the same operating model of abusing remote-access surfaces. Defenders should use fingerprints to detect and correlate compromise, but the underlying exposure still has to be removed.

Operation WrtHug illustrates the rise of device-level relay infrastructure in espionage tradecraft: this is not just malware on endpoints, but compromise of network appliances that sit at the boundary of identity, access, and transport trust. That makes this a useful case for NIST-CSF and MITRE ATT&CK thinking, especially around exposure management, credential and access abuse, and persistent infrastructure. The practitioner takeaway is to govern routers as part of the access plane, not as passive plumbing.

What this signals

Edge devices need the same lifecycle discipline as identities: when a router exposes durable remote-access surfaces and remains in service after support ends, it behaves like an unmanaged access path rather than a passive network component. That means inventory completeness, certificate tracking, and decommissioning decisions matter as much as patch cadence.

The broader lesson for practitioners is that perimeter trust is increasingly an access-control problem, not only a network architecture problem. If an exposed appliance can be turned into relay infrastructure, the programme has to govern the device, its services, and its certificates as a single control surface.

For practitioners

• Inventory and classify edge devices Build a complete inventory of routers, remote-access appliances, and other internet-facing edge devices, then tag end-of-life systems separately for accelerated remediation or isolation.
• Remove exposed remote-access services Disable or tightly restrict services such as AiCloud and other externally reachable management interfaces on devices that do not require them for business use.
• Prioritise firmware and support status Treat unsupported firmware and vendor end-of-support dates as risk triggers that move a device into containment, replacement, or network segmentation.
• Monitor certificate and service fingerprints Track unusual self-signed certificates, atypical expiries, and repeated service artefacts across fleet telemetry to identify clustered compromise patterns.

Key takeaways

• Operation WrtHug shows how unsupported routers can be converted into persistent espionage infrastructure when public flaws remain reachable.
• The report ties the campaign to thousands of compromised ASUS devices and a distinctive long-lived certificate pattern used for tracking.
• Network defence teams should treat edge-device lifecycle management, service exposure, and certificate monitoring as core controls, not secondary hygiene.

Key terms

• End-Of-Life Device: Hardware or software no longer receiving full vendor support, security updates, or reliable maintenance. These assets can remain connected and trusted in production long after their risk profile has changed, making them attractive for exploitation and persistence.
• Operational Relay Box: A compromised device that attackers repurpose as covert infrastructure for routing, hiding, or sustaining access. The device may not be the final target, but it becomes part of the attacker’s control plane and can support espionage, command traffic, or lateral access.
• Command injection: Command injection occurs when attacker-controlled data is inserted into a shell command and changes what the process executes. In AI tooling, that often happens through wrappers, plugins, or installation flows that turn paths or prompts into shell strings. The impact is privilege abuse through the process’s inherited authority.
• Service Fingerprinting: The process of inferring what software or device is behind an open port by observing banners, certificate data, timing, and protocol behaviour. It matters because fingerprinting reduces uncertainty and helps an attacker quickly rank exposed systems by likely vulnerability, ownership, and operational value.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect access control, lifecycle discipline, and governance decisions across the identity stack.