Topic starter
11/07/2026 8:36 pm
TL;DR: Thousands of ASUS routers worldwide were compromised through multiple publicly known vulnerabilities, with over 50,000 unique IP addresses observed across the last six months and a distinctive 100-year TLS certificate used to track the campaign, according to SecurityScorecard. The lesson is that unmanaged edge devices create persistent espionage infrastructure long after patching windows close.
Editorial analysis by NHI Mgmt Group, based on content published by SecurityScorecard: “Operation WrtHug, The Global Espionage Campaign Hiding in Your Home Router”.
By the numbers:
- The campaign used a shared, self-signed TLS certificate with an unusually long 100-year expiration period.
- CVE-2023-39780 is rated 8.8 on the CVSS severity scale, while CVE-2025-2492 carries a 9.2 score.
Key questions
Q: What breaks when internet-facing routers are left on unsupported firmware?
A: Unsupported routers become long-lived footholds because attackers can exploit known flaws after defenders have stopped actively maintaining the device.
Q: Why do vulnerable edge devices create persistent espionage risk?
A: Because attackers can reuse the same exposed management path across many devices and keep a trusted network position even after the original exploit is understood.
Q: What are the signs that router compromise is being used for relay activity?
A: Look for unusual self-signed certificates, repeated service fingerprints across distant IP addresses, unexpected remote-access exposure, and devices that continue to communicate normally while behaving as shared infrastructure.
Practitioner guidance
- Inventory and classify edge devices Build a complete inventory of routers, remote-access appliances, and other internet-facing edge devices, then tag end-of-life systems separately for accelerated remediation or isolation.
- Remove exposed remote-access services Disable or tightly restrict services such as AiCloud and other externally reachable management interfaces on devices that do not require them for business use.
- Prioritise firmware and support status Treat unsupported firmware and vendor end-of-support dates as risk triggers that move a device into containment, replacement, or network segmentation.
Bottom line: Operation WrtHug shows how unsupported routers can be converted into persistent espionage infrastructure when public flaws remain reachable.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:04 pm
Edge-device lifecycle failure is the core governance gap here: the campaign succeeds because organisations often treat routers as infrastructure, not as governed security assets with a lifecycle. Once a device reaches end of life, exposed services and stale firmware become a long-tail access problem rather than a routine patching issue. Practitioners should treat unsupported edge gear as a governance exception, not a background maintenance item.
A question worth separating out:
Q: How should network teams decide whether to replace or contain ageing routers?
A: If a device is end-of-life, still internet-exposed, or carrying services that cannot be tightly governed, replacement is usually the safer decision. Containment can buy time, but it should be temporary and backed by segmentation, monitoring, and a removal plan.
👉 Read our full editorial: Operation WrtHug shows how router EoL flaws enable espionage