THE FBI has issued an urgent warning over Wifi routers and you’re urged to check your device to stop the threat.
It comes as the devices found in people’s homes are being “injected” with malware and sold on shady underground networks.
2
2
Hackers are using the infected routers to hide behind while carrying out crimes, including data theft and cyberattacks.
In a flash alert, the FBI revealed the devices are being sold as proxies on the 5Socks and AnyProxy networks.
That means criminals can use your router to mask their real identity while doing illegal things online.
HACKED DEVICES
The hacked devices are older models that no longer receive security updates or patches.
Targeted routers include several Linksys models – E1200, E2500, E1000, E4200, E1500, E300, E3200, E1550 – and WRT models 320N, 310N, and 610N.
These end-of-life devices are being hijacked with malware called TheMoon, which gives hackers full access.
“End of life routers were breached by cyber actors using variants of TheMoon malware botnet,” the FBI stated.
The infected routers are added to giant networks that route criminal traffic and hide the real source.
Some of the infected routers have been linked to Chinese state-sponsored hackers running spy operations against US infrastructure.
The malware allows remote control, letting cybercriminals use your home internet like a cloak.
“The proxies can be used by threat actors to obfuscate their identity or location,” the FBI said.
Once inside, the malware connects to a command server to receive instructions and spread to more devices.
It doesn’t even need a password to break in – it scans for open ports and slips in through weak spots.
TheMoon was first discovered in 2014 but is still being used in fresh attacks with new variants.
Affected Routers
The FBI warns these end-of-life models are being hijacked with malware:
LINKSYS
- E1000
- E1200
- E1500
- E1550
- E2500
- E300
- E3200
- E4200
- WRT310N
- WRT320N
- WRT610N
CRADLEPOINT
CISCO
“Recently, some routers at end of life, with remote administration turned on, were identified as compromised by a new variant of TheMoon malware,” the FBI added.
YOUR ROUTER MAY BE COMPROMISED
Once infected, the routers act like middlemen – helping crooks steal crypto, rent out crime tools, and hide their tracks.
Signs your router may be compromised include overheating, connection issues, new admin accounts, and strange settings.
You might also notice slow speeds or weird traffic patterns on your network.
To stay safe, the FBI recommends replacing outdated routers with new ones that still get updates.
If that’s not an option, install the latest firmware, change your default passwords, and turn off remote access.
The FBI has also shared technical details to help spot infected devices.
You should also reset passwords, contact service providers, and keep an eye on your accounts for suspicious logins.