Was I hacked or just a weird bug?

[optimusthyme357]

Hi All,

Hoping to get some answers. My router is AX86U, and I'm not sure which exact version of the firmware it was running at the time, but it was definitely 386.2_X.

Today I was having some connection issues, went to log in to my router's GUI to reboot, and the address didn't work. (I had my login page setup to use https with a custom port number for added security, so I normally logged in using https://192.168.50.1ORTNUMBERHERE. The router was also configured to not allow access from outside the network.) I tried the default http://192.168.50.1, and it connected, but the entire page was in either Japanese or Chinese. I tried my normal login, thinking it could be a bug/glitch, and it did not work.

At this point I panicked, unplugged everything, and hard reset + reconfigured the router while it was offline. Looking back, maybe I should've tried the default admin:admin login to check for logs, but I didn't. The weird part about the whole thing is my network SSID and password were never changed. Last time I logged into the web GUI prior to this was about a month ago, so it's hard to say when this could've happened.

The network has now been set up with entirely new passwords, logins, and SSIDs, but it's bothering me that this happened. I also uploaded a picture of the login screen after my failed login attempt, if that helps any.

I tried googling a bit, but nothing really matched my situation. Never had anything like this happen before and I've been running Merlin on Asus routers for over 10 years now. Is this something that is typical when someone's network gets hacked, or is it more likely a bug?

Thanks

 

[Tech9]

At this point I panicked, unplugged everything, and hard reset + reconfigured the router while it was offline.

You did the right thing.

 

[L&LD]

Welcome to the forums @optimusthyme357.

What is typical for a network when it's hacked is to make it appear as if nothing is happening, so that the hacking can continue.

It seems like your router simply got reset. Are you the sole person with physical access to it? Maybe this is someone's idea of a joke? Or, a way to try to cover their tracks?

It didn't sound like you panicked, you did what you should have done.

Have you flashed the the latest firmware? Did you make sure to do another full reset afterward?