Cybercriminals have hacked into thousands of Asus routers, possibly as a prelude to a widescale botnet attack, says a security firm.