Cybercriminals have hacked into thousands of Asus routers, possibly as a prelude to a botnet attack, says a security firm.