China's Router Rodeo: Hackers Hijack Home Gear for Global Spy Ops

This is your Digital Frontline: Daily China Cyber Intel podcast. This is Ting, your guide into the digital depths of China’s cyber shenanigans—think of me as your cyber librarian, but way more caffeinated and much less patient with hackers named “WrtHug.” Let’s get to the fun stuff, listeners. In just the past 24 hours, US cyber defenders have been playing whack-a-mole on several fronts and China is trending for all the wrong reasons. First up, the operation codenamed WrtHug. According to SecurityScorecard, this China-linked campaign has compromised thousands of legacy ASUS WRT routers globally, exploiting at least six different vulnerabilities—yes, even the ones most people forgot existed. The attackers are using these hijacked devices, especially those abandoned in small offices and home offices, as stepping stones for broader espionage. Half the victims are in Taiwan, but plenty are right here in the States. Gilad Maizles says it best: this is a masterclass in using consumer gear as a global spy network. Word to all the IT folks: if your router is older than your favorite hoodie, update or replace it, stat. WrtHug is hardly alone. A separate, China-aligned threat actor known as PlushDaemon, as reported by The Record, has been caught using similar strategies—hijacking routers to reroute DNS queries to malicious servers and to keep their infrastructure nimble and hard to kill. And if that wasn’t enough router-rage, Chinese advanced persistent threat (APT) groups are still refining how they slip malware into targets by hijacking legitimate software updates—think your Windows patch Tuesday, but with a side of spyware, as reported by BankInfoSecurity. Now, what’s Congress doing while all this router-rodeo ramps up? In a rare display of bipartisan action, the House just passed the PILLAR Act and the Strengthening Cyber Resilience Against State-Sponsored Threats Act. Representative Andy Ogles wants you to know these bills reauthorize federal cyber grants and set up an interagency task force to take on China’s hacking machinery, head on. The new laws will boost funding, reward multi-factor authentication, and give much-needed love to operational tech and AI security. My favorite feature? More muscle for state and local governments—which, let’s be honest, need all the help they can get with today’s attack volume. What sectors are feeling the squeeze? Tech, higher education—look at Princeton’s breach this week for proof—manufacturing, and operational tech are top targets. Trellix and recent threat snapshots show manufacturing is still king among hacker targets, clocking in at over 40% of detections. So what do the pros recommend? It’s all hands on deck. Patch everything, especially routers and endpoints. Double down on multi-factor authentication and run continuous user security training; phishing lures are getting absurdly persuasive, as 200,000 New Yorkers discovered when a scam vendor texted them fake bank alerts after a recent breach. AI-driv This content was created in partnership and with the help of Artificial Intelligence AI.