Incident Types: The types of cybersecurity incidents that have occurred include Cyber Attack, Ransomware, Malware and Vulnerability.

Detection and Response: The company detects and responds to cybersecurity incidents through an remediation measures with recommended users to apply the patch, and and containment measures with firmware update (version 1.1.2.3_1010) for dsl-ac51, dsl-n16, dsl-ac750, containment measures with disabling internet-accessible services (remote wan, port forwarding, ddns, vpn, dmz, port triggering, ftp) for unpatchable devices, containment measures with recommending strong passwords, avoiding credential reuse, and regular update checks, and remediation measures with firmware patch, remediation measures with security hardening guidance for end-of-life devices, and communication strategy with public advisory via asus support portal, communication strategy with networking page notifications, communication strategy with media outreach, and incident response plan activated with collaboration between securityscorecard and asus, and third party assistance with securityscorecard, and communication strategy with public disclosure via securityscorecard/asus report, communication strategy with media coverage (e.g., techradar), and containment measures with patch deployment (asus system control interface v3.1.48.0 for x64, v4.2.48.0 for arm), and remediation measures with urgent patch application via windows update, remediation measures with monitoring for suspicious activity, and communication strategy with public disclosure, communication strategy with user advisory for patch verification, and enhanced monitoring with recommended for exploitation attempts, and remediation measures with software product phased out and retired..

Common Attack Types: The most common types of attacks the company has faced is Vulnerability.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Compromised Update Server, Improper access request validation in router firmware and exploited n-day vulnerabilities in ASUS routers.

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Proprietary firmware/software and camera source code.

Incident Response Plan: The company's incident response plan is described as collaboration between SecurityScorecard and ASUS, .

Third-Party Assistance: The company involves third-party assistance in incident response through SecurityScorecard, .

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Recommended users to apply the patch, Firmware patch, Security hardening guidance for end-of-life devices, , Urgent patch application via Windows Update, Monitoring for suspicious activity, , Software product phased out and retired.

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by firmware update (version 1.1.2.3_1010) for dsl-ac51, dsl-n16, dsl-ac750, disabling internet-accessible services (remote wan, port forwarding, ddns, vpn, dmz, port triggering, ftp) for unpatchable devices, recommending strong passwords, avoiding credential reuse, and regular update checks, , patch deployment (asus system control interface v3.1.48.0 for x64, v4.2.48.0 for arm) and .

Key Lessons Learned: The key lessons learned from past incidents are Router vulnerabilities are high-value targets for botnet operators (e.g., Vicious Trap's AyySSHush campaign).,End-of-life hardware poses persistent risks if not properly secured or decommissioned.,Proactive firmware updates and service hardening are critical for mitigating authentication bypass flaws.End-of-life (EOL) devices pose significant risks if left unpatched or in use.,State-sponsored actors leverage n-day vulnerabilities in legacy systems for espionage infrastructure.,Long-lived certificates (e.g., 100-year TLS) can serve as indicators of sophisticated, persistent campaigns.,Geopolitical alignment of compromised assets (e.g., Taiwan/Southeast Asia) highlights strategic targeting.Importance of understanding historical vulnerabilities to evaluate past security assessments and the risks of trusted channels in supply-chain attacks. Emphasis on routine software audits and diligence regarding manufacturer updates for robust cybersecurity practices.

Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Verify installed MyASUS version via Settings > About, Apply security updates (v3.1.48.0 for x64, v4.2.48.0 for ARM) immediately via Windows Update, Organizations and users should focus on legitimate vulnerability reports and updates concerning currently utilized systems to manage and protect against actual threats., Prioritize patch deployment in corporate environments to mitigate lateral movement risks, Monitor systems for signs of exploitation (e.g. and unauthorized privilege escalation).

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: ASUS Security Advisory, and Source: CISA KEV Catalog (CVE-2023-39780, CVE-2021-32030)Url: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, and Source: GreyNoise/Sekoia Report on Vicious Trap (AyySSHush Botnet), and Source: TechRadar, and Source: SecurityScorecard & ASUS joint report, and Source: ASUS Security Advisory, and Source: Hackread.com.

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Public Advisory Via Asus Support Portal, Networking Page Notifications, Media Outreach, Public Disclosure Via Securityscorecard/Asus Report, Media Coverage (E.G., Techradar), Public Disclosure and User Advisory For Patch Verification.

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Asus Support Portal Notifications, Public Security Bulletin, Install Firmware Version 1.1.2.3 1010 Immediately., Disable Internet-Exposed Services If Unable To Patch., Follow Security Hardening Guidelines For End-Of-Life Devices., , Asus Likely Issued Advisories For Affected Router Models (4G-Ac55U, 4G-Ac860U, Dsl-Ac68U, Gt-Ac5300, Gt-Ax11000, Rt-Ac1200Hp, Rt-Ac1300Gplus, Rt-Ac1300Uhp), , Users and organizations advised to update immediately and Public notification issued with patch instructions.

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Securityscorecard, , Recommended for exploitation attempts.

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Firmware Patch To Block Authentication Bypass (Version 1.1.2.3 1010)., Security Guidance For Unpatchable/End-Of-Life Devices., Public Awareness Campaign On Router Hardening., , Patch Release (V3.1.48.0, V4.2.48.0), Public Disclosure And Update Advisory, , Phasing out and retiring the End-of-Life (EoL) software product.

Last Attacking Group: The attacking group in the last incident were an Chinese state-sponsored actors and Everest Ransomware Group.

Most Significant Data Compromised: The most significant data compromised in an incident were 1TB of data and including camera source code.

Most Significant System Affected: The most significant system affected in an incident were ASUS DSL-AC51ASUS DSL-N16ASUS DSL-AC750Potentially other DSL-series routers and thousands of ASUS routers and ASUS personal computers (desktops, laptops, NUC systems, All-in-One PCs) running MyASUS.

Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was securityscorecard, .

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Firmware update (version 1.1.2.3_1010) for DSL-AC51, DSL-N16, DSL-AC750Disabling internet-accessible services (remote WAN, port forwarding, DDNS, VPN, DMZ, port triggering, FTP) for unpatchable devicesRecommending strong passwords, avoiding credential reuse, and regular update checks, Patch deployment (ASUS System Control Interface v3.1.48.0 for x64 and v4.2.48.0 for ARM).

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were 1TB of data and including camera source code.

Most Significant Lesson Learned: The most significant lesson learned from past incidents was Geopolitical alignment of compromised assets (e.g., Taiwan/Southeast Asia) highlights strategic targeting., Importance of understanding historical vulnerabilities to evaluate past security assessments and the risks of trusted channels in supply-chain attacks. Emphasis on routine software audits and diligence regarding manufacturer updates for robust cybersecurity practices.

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Regularly check for firmware updates and avoid credential reuse., Apply security updates (v3.1.48.0 for x64, v4.2.48.0 for ARM) immediately via Windows Update, Disable all internet-facing services (remote WAN, port forwarding, etc.) if patching is not feasible., Enhance detection for ORB (Operational Relay Box)-like traffic patterns., Verify installed MyASUS version via Settings > About, Organizations and users should focus on legitimate vulnerability reports and updates concerning currently utilized systems to manage and protect against actual threats., Public-private collaboration for threat intelligence sharing (e.g., ASUS-SecurityScorecard model)., Prioritize patch deployment in corporate environments to mitigate lateral movement risks, Replace end-of-life routers with supported models where possible., Monitor systems for signs of exploitation (e.g., unauthorized privilege escalation), Immediately apply firmware updates for affected ASUS DSL-series routers., Monitor for unusual certificate lifetimes (e.g., 100-year TLS) as potential IoCs., Implement network segmentation to limit lateral movement via compromised routers., Monitor for suspicious activity (e.g., unauthorized access, botnet C2 traffic)., Replace or decommission EOL networking devices to eliminate attack surfaces., Use strong and unique passwords for router administration and Wi-Fi networks..

Most Recent Source: The most recent source of information about an incident are TechRadar, CISA KEV Catalog (CVE-2023-39780, CVE-2021-32030), ASUS Security Advisory, GreyNoise/Sekoia Report on Vicious Trap (AyySSHush Botnet), Hackread.com and SecurityScorecard & ASUS joint report.

Most Recent URL for Additional Resources: The most recent URL for additional resources on cybersecurity best practices is https://www.cisa.gov/known-exploited-vulnerabilities-catalog .

Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing (no confirmed in-the-wild exploitation reported).

Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was ASUS support portal notifications, Public security bulletin, Users and organizations advised to update immediately, .

Most Recent Customer Advisory: The most recent customer advisory issued were an Install firmware version 1.1.2.3_1010 immediately.Disable internet-exposed services if unable to patch.Follow security hardening guidelines for end-of-life devices., ASUS likely issued advisories for affected router models (4G-AC55U, 4G-AC860U, DSL-AC68U, GT-AC5300, GT-AX11000, RT-AC1200HP, RT-AC1300GPLUS, RT-AC1300UHP) and Public notification issued with patch instructions.

Most Recent Entry Point: The most recent entry point used by an initial access broker was an Compromised Update Server.

Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Improper validation of access requests in DSL-series router firmware, Use of EOL routers with unpatched n-day vulnerabilitiesLack of automatic updates or user patching for legacy devicesAbuse of trusted firmware (AsusWRT) for malicious purposes, Privilege escalation vulnerability in ASUS System Control Interface Service, Exploitation of trusted software update distribution network for ASUS Live Update utility.

Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Firmware patch to block authentication bypass (version 1.1.2.3_1010).Security guidance for unpatchable/end-of-life devices.Public awareness campaign on router hardening., Patch release (v3.1.48.0, v4.2.48.0)Public disclosure and update advisory, Phasing out and retiring the End-of-Life (EoL) software product.