Russian Hackers Reset Thousands of Routers Across 23 States
Russian hackers tied to the GRU compromised home and small office routers across 23 states, and the FBI remotely reset thousands of them. The operation cut off access to devices that could intercept traffic and steal credentials. The scope runs from more than 200 organizations to 5,000 consumer devices, so this was not a narrow intrusion.
APT28 and SOHO Routers
The attack used a Domain Name System hijacking operation, which changed default network settings on small-office/home-office routers so DNS requests could be intercepted. Daniel Dos Santos, vice president of research at Forescout, said, "There is a big trend of exploiting routers these days, and that goes both for the consumer and enterprise or corporate routers".
The FBI says the campaign has been ongoing since at least 2024. Microsoft identified more than 200 organizations and 5,000 consumer devices affected by the GRU-linked operation, which gives the scale a concrete edge that goes beyond a routine scan or nuisance intrusion.
TP-Link TL-WR841N
The FBI’s notice refers to the TP-Link TL-WR841N, a Wi-Fi 4 model originally released in 2007. The UK’s National Cyber Security Centre also listed 23 TP-Link models targeted in the campaign. A TP-Link Systems spokesperson said the affected models had reached End of Service and Life status several years ago.
That leaves owners with a practical task, not a theoretical one: update to the latest firmware and change default login credentials. Those steps do not undo every risk in a compromised router, but they are the only response named in the government guidance and they address the easiest path attackers used to gain control.
April 7 Federal Advisory
On April 7, a joint federal advisory laid out the scope of the operation and the court-authorized reset that disrupted it. The hard part now is the cleanup on devices that were already touched, especially older models that are no longer supported and may still sit in homes and small offices long after their original release.
