Still Use One of These Old Routers? It's Vulnerable to Hackers, FBI Says

A group of hackers has been taking over old, out-of-date routers to help them pull off cyberattacks, according to the FBI.

The agency identified 13 “end of life” internet routers mainly sold by Linksys under the Cisco brand that have come under attack. It also seized two websites, Anyproxy and 5Socks, which used the hijacked routers to offer “proxy services,” a method of rerouting internet traffic through external servers to mask users’ IP addresses.

The FBI alleges that Anyproxy and 5Socks sold their proxy services to “help cybercriminals hide their activities.” The sites have since been replaced with a Justice Department seizure notice.

Seizure notice

(Credit: FBI/DOJ)

The FBI’s alert lists the 13 vulnerable router models:

The affected routers no longer receive software support from their vendors, enabling hackers to exploit unpatched vulnerabilities. They have been spreading a version of the “TheMoon” malware, which has targeted Wi-Fi routers since at least 2014.

“TheMoon does not require a password to infect routers; it scans for open ports and sends a command to a vulnerable script,” the FBI adds. “The malware contacts the command and control (C2) server and the C2 server responds with instructions, which may include instructing the infected machine to scan for other vulnerable routers to spread the infection and expand the network.”

Recommended by Our Editors

The same malware can give hackers persistent access to the router, and lead to the formation of a botnet, an army of infected computers capable of hosting malicious activity, including DDoS attacks.

The FBI’s alert includes indicators of compromise. But to fully address the threat, the agency is recommending users “replace compromised devices with newer models or prevent infection by disabling remote administration and rebooting the router.” So, affected customers might consider buying a router that receives regular security updates.

Get Our Best Stories!