Loading story…
The FBI advised consumers and small businesses to reboot internet routers after malware targeting network devices raised concerns that compromised hardware could be used for broader malicious activity. The guidance was aimed at disrupting infections affecting home and small-office routers, which can be abused for traffic redirection, credential theft, botnet operations, and persistent access to connected networks.
Security reporting noted that a reboot may temporarily interrupt some malware operations, but it is not a complete remediation step on its own. Users were urged to follow up by updating router firmware, changing default or exposed administrative credentials, disabling remote management where unnecessary, and replacing unsupported devices that no longer receive security patches.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
ESET published an article explaining the FBI's recommendation to reboot routers, discussing why the advice was given and what users should do. The piece helped contextualize the ongoing response to the router malware threat.
Reporting on VPNFilter mitigation clarified that rebooting a router only disrupts non-persistent stages of the malware, while Stage 1 remains installed. Users were advised to perform a factory reset, update firmware, change default passwords, and disable remote administration to fully remediate affected devices.
The FBI issued public guidance urging people to reboot their routers as part of its response to a router-focused cyber threat. The recommendation was aimed at disrupting malicious activity affecting home and small-office networking devices.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The FBI and Justice Department said they disrupted multiple Russian GRU operations that hijacked small office/home office routers to conceal espionage activity, proxy malicious traffic, and steal credentials. In one court-authorized action, **Operation Dying Ember**, agents remotely accessed hundreds of compromised **Ubiquiti EdgeOS** routers infected with **Moobot**, deleted malware and related files, and temporarily changed firewall rules to cut off **APT28**—also tracked as **Fancy Bear**, **Sednit**, and **Forest Blizzard**—without disrupting normal device use. Officials said the botnet had originally been built by cybercriminals abusing internet-exposed routers with default administrator passwords before being repurposed by Russia’s **GRU Unit 26165**. U.S. authorities later said a related GRU campaign also compromised SOHO routers, including **TP-Link** devices, to alter **DNS** settings and conduct adversary-in-the-middle attacks against **TLS** sessions, including Outlook traffic, in operations affecting government, IT, telecommunications, and energy targets. In **Operation Masquerade**, the FBI sent commands to infected routers to collect forensic data and reset malicious DNS configurations, removing Russian access from the devices. Microsoft and U.S. agencies linked the activity to APT28 and warned that router compromises can enable traffic redirection, credential theft, malware delivery, and denial-of-service attacks, urging organizations to patch firmware, verify DNS settings, disable unnecessary remote management, and replace end-of-life hardware.
Jun 29, 2026
Palo Alto Networks Unit 42 reported that attackers exploited vulnerable **home and small office wireless routers** and used the compromised devices as infrastructure to target **gaming servers**. The activity turned consumer and small-business networking equipment into a distributed attack platform, allowing malicious traffic to be routed through legitimate internet connections and making the attacks harder to trace directly to the operators. The report highlights how poorly secured edge devices can be repurposed beyond simple botnet activity and used to disrupt online gaming environments. For defenders, the incident underscores the need to patch router firmware, disable exposed remote administration features, replace default credentials, and monitor for unusual outbound traffic from SOHO networking equipment that may indicate compromise.
Jul 12, 2026
The FBI disrupted an **APT28** operation that compromised internet-connected routers to enable **DNS hijacking**, according to reporting citing U.S. and UK government findings. The campaign abused vulnerable edge devices to alter DNS settings and redirect traffic, giving the Russian state-linked group a way to intercept victim communications, harvest credentials, and support follow-on espionage activity. The activity was significant enough to prompt public warnings from the FBI and the UK **NCSC**, which described router exploitation as a key enabler for the hijacking operations. Government guidance tied the operation to exploitation of routers exposed to the internet and urged organizations to harden perimeter infrastructure by patching devices, restricting remote administration, rotating credentials, and reviewing DNS configurations for unauthorized changes. The disclosures underscore how Russian espionage actors continue to rely on stealthy network-level tradecraft—using compromised infrastructure rather than malware alone—to persist in victim environments and covertly redirect or monitor traffic.
Jun 29, 2026