Зашел на роутер по ssh, среди процессов увидел процессы со странным именем:
{jiplqebe560rqed} g4ovl2ovimnvbskpel1lwl8p
PID USER VSZ STAT COMMAND
...
2147 admin 1392 S /usr/sbin/dropbear -4
2148 admin 1556 R ps
16331 admin 1432 S /usr/sbin/dropbear -4
23085 admin 356 S {jiplqebe560rqed} g4ovl2ovimnvbskpel1lwl8p
23087 admin 332 S {jiplqebe560rqed} g4ovl2ovimnvbskpel1lwl8p
26248 admin 3592 S {jiplqebe560rqed} g4ovl2ovimnvbskpel1lwl8p
27037 admin 476 S {jiplqebe560rqed} g4ovl2ovimnvbskpel1lwl8p
27330 admin 1396 S /usr/sbin/dropbear -4
27490 admin 1392 S /usr/sbin/dropbear -4
27586 admin 1432 S /usr/sbin/dropbear -4
28274 admin 1392 S /usr/sbin/dropbear -4
28379 admin 472 S {jiplqebe560rqed} g4ovl2ovimnvbskpel1lwl8p
28382 admin 500 S {jiplqebe560rqed} g4ovl2ovimnvbskpel1lwl8p
28476 admin 1432 S /usr/sbin/dropbear -4
28543 admin 1432 S /usr/sbin/dropbear -4
29408 admin 0 SW [kworker/0:0]
30302 admin 1392 S /usr/sbin/dropbear -4
30761 admin 1440 S /usr/sbin/dropbear -4
...
на роутере стоит BusyBox v1.24.2 (2016-09-25 23:47:16 CST) built-in shell (ash)
