The Black Lotus Labs team at Lumen has discovered KadNap, a sophisticated malware targeting Asus routers and conscripting them into a botnet used for proxying malicious traffic. KadNap utilizes a custom Kademlia DHT protocol to conceal its infrastructure and evade detection, making disruption difficult. The botnet, with over 14,000 infected devices, is marketed through a proxy service called "Doppelganger", linked to the previously known Faceless service. A significant portion of the victims (60%) are located in the United States. Lumen has proactively blocked traffic to KadNap’s control infrastructure and is sharing indicators of compromise.
Asus has introduced the NUC 16 Pro mini PC, supporting up to Intel Core Ultra X9 388H processors with Arc B390 graphics. It offers up to a 50% boost in 3D graphics and 20% improvement in system performance compared to the NUC 15 Pro.
A botnet named "AyySSHush" has compromised over 9,000 ASUS routers, exploiting vulnerabilities to establish a persistent SSH backdoor. The botnet targets multiple router models and employs stealthy techniques to evade detection, potentially laying the groundwork for future malicious activities.
The ROG DIMM.2
1. I enabled JFFS custom scripts and configs
2. I enabled SSH
3. Via SSH I created a file named dnsmasq.conf.add in /jffs/configs/
4. I chmod 755 /jffs/configs/dnsmasq.conf.add to make it executable
(I don't think this is necessary)
5. I add all my dhcp static leases in the format:
dhcp-host=49:EF:0C:24:7F:16,D-Link-AP,192.168.2.10,1440
to this file.
6. I disabled manual assignment of DHCP leases
7. I reboot the router
2. I enabled SSH
3. Via SSH I created a file named dnsmasq.conf.add in /jffs/configs/
4. I chmod 755 /jffs/configs/dnsmasq.conf.add to make it executable
(I don't think this is necessary)
5. I add all my dhcp static leases in the format:
dhcp-host=49:EF:0C:24:7F:16,D-Link-AP,192.168.2.10,1440
to this file.
6. I disabled manual assignment of DHCP leases
7. I reboot the router
