ac68u asus port 18017 hack forwarding

I've had someone breaking into my 68u router for some time now. The latest break-in from yesterday was on the 380.64 firmware build in which they have prerouted (port forwarding, even though I have port forwarding switched off) all traffic through ports 18017 (tcp) & 18018 (udp.) Googling asus...