There is one computer in your home that has been running continuously for months, has never been updated, has a password you last thought about on the day you moved in, and sits directly between every other device you own and the internet.
It is the box with the antennas. Almost nobody logs into it. That is exactly why state sponsored intelligence services keep going after it.
Earlier this year the FBI, the NSA and law enforcement partners across more than a dozen countries announced they had disrupted a network of compromised small office and home office routers being run by Russian military intelligence. The follow up advice was blunt and it has been circulating ever since: restart your router. That advice is good. It is also incomplete in a way that matters, because the specific attack described in that advisory is one that survives a restart without any trouble at all.
The short version
- Who: the GRU’s 85th Main Special Service Center, better known as APT28, Fancy Bear or Forest Blizzard
- What they did: compromised consumer grade routers, mostly TP-Link, and rewrote the DNS settings the router hands out to every device on the network
- The entry point: CVE-2023-50224 on TP-Link WR841N units, an authentication bypass that leaks stored credentials through a crafted HTTP request
- The goal: sit in the middle of browser sessions and desktop mail clients to harvest passwords and OAuth tokens
- Who was targeted: government, military, defense contractors and tech firms across the Czech Republic, Italy, Lithuania, Poland, Ukraine, the UAE and the US
- The response: a court authorized operation that remotely reset thousands of infected devices, plus a joint advisory in April 2026
- The catch: a reboot clears memory resident malware. It does not clear a rewritten DNS setting, because that is saved configuration.
What the attack actually did
Most people picture router hacking as someone stealing your Wi-Fi. This was not that. It was quieter and considerably more useful to an intelligence service.
Your router does not just move packets. It also tells every laptop, phone and smart TV on your network which DNS server to use, through DHCP. DNS is the lookup layer that turns a name you type into an address a machine can reach. Whoever controls that lookup controls where your traffic actually goes, regardless of what the address bar says.
APT28 changed that setting. The compromised routers began handing out attacker controlled DNS servers to everything connected to them. From there the group ran adversary in the middle attacks against follow on connections, including browser sessions and desktop applications, with the goal of collecting passwords, OAuth tokens and other credentials for web and email services.
Activity traced back to at least 2024, with a related cluster using rented virtual servers to reach the routers from around August 2025. Nothing about it needed a zero day or a nation state budget. The way in was a public vulnerability in a cheap router that most owners had never patched.
| Stage | What happened | Does a reboot undo it? |
|---|---|---|
| 1. Discovery | Internet wide scanning finds routers with exposed admin interfaces and known flaws | No. Your device is still findable the second it comes back up. |
| 2. Access | An authentication bypass leaks stored credentials through a crafted HTTP request | No. The vulnerability lives in firmware. |
| 3. DNS rewrite | DHCP settings are edited to hand out attacker owned DNS servers | No. This is saved config, and it reloads on boot. |
| 4. Interception | Traffic is steered through infrastructure that can sit between you and the service | Only until the next lease renews with the same poisoned setting. |
| 5. Implants | Any malicious process running only in memory | Yes. This is the part a restart genuinely kills. |
So why does everyone say reboot
Because for most router malware, it works, and it costs you ninety seconds.
Routers are small embedded computers with very little storage. Attackers who get onto one usually cannot write large payloads to flash without risking a device that fails to boot and gets replaced. So the standard pattern is to keep the working payload in RAM. Pull the plug and RAM empties. The infection is gone.
That is not a theory. It is the reason the FBI publicly asked people to reboot routers back in the VPNFilter era, and the reason security teams still recommend a monthly restart as basic hygiene. A reboot also forces the device to reload its configuration and, on many models, to check for and apply firmware it had already downloaded.
The lesson security researchers learned the hard way
VPNFilter is the case study everyone in this field points to, and it is the reason “just reboot” became a contested piece of advice.
That campaign hit hundreds of thousands of devices and used a three stage design. Stages two and three carried the actual capability, and both lived in memory, so a restart wiped them. Stage one did not. It was written to persistent storage specifically so it would survive a reboot, phone home, and pull the payload down again. Owners who rebooted felt safer for roughly as long as it took the device to reconnect.
The same logic applies to the GRU campaign, only worse, because the payload was never the point. The point was a configuration change. You can reboot a router with poisoned DNS settings a hundred times and it will faithfully reload those settings every single time.
If you suspect you were actually hit
A reboot is not the fix. A factory reset is, followed immediately by a firmware update and a fresh admin password, in that order. Resetting first and updating second matters, because a reset restores the old vulnerable firmware along with the old defaults, and that gap is exactly what got scanned in the first place. Do not restore a saved configuration backup afterward. If the config was tampered with, restoring it puts the attacker’s settings straight back.
The checklist that is actually worth ten minutes
The joint advisory and the National Cybersecurity Alliance land on the same short list. None of it is exotic, and all of it closes doors that scanning tools look for constantly.
| Do this | Why it matters | Time |
|---|---|---|
| Change the admin password | Default credentials get published in lists and traded. Aim for 16 characters, stored in a password manager, and turn on multi factor authentication for admin access if the model supports it. | 2 min |
| Turn off remote management | If the admin panel answers from the open internet, you are in every scan result. Almost no home user needs this on. | 1 min |
| Update the firmware | This is the only step that closes the actual hole. Enable automatic updates if the option exists. | 5 min |
| Check your DNS settings | Look at the DHCP and WAN pages. If the DNS servers are anything you do not recognize and did not set, that is the finding. | 2 min |
| Take certificate warnings seriously | An interception attack usually announces itself as a browser or mail client warning that people click through out of habit. | Ongoing |
| Reboot monthly | Cheap insurance against anything living in memory, and it costs you nothing but a minute of downtime. | 1 min |
At some point patching stops being an option
The uncomfortable part of the advisory is the line about upgrading end of support devices, because that is a spending recommendation dressed as a security one.
Consumer routers typically stop receiving meaningful firmware updates around five years after launch, and budget models often go quiet far sooner, sometimes after two. Premium hardware can run five to seven years of support. Once a device is past that line, no amount of checklist work helps, because there is nobody left to write the patch for the next vulnerability that gets published.
The router in this campaign is a good illustration. The WR841N is an inexpensive, enormously popular model that has been sold in huge numbers for over a decade. That combination, cheap and everywhere and old, is precisely what makes a device attractive to scan for. There is nothing wrong with buying budget networking gear. There is something wrong with running it in 2026 on firmware from 2019.
This is also not the first time your router has been the interesting part of the story. We have watched a similar credential harvesting trick play out on hotel Wi-Fi networks poisoned to steal Microsoft 365 logins, seen takedowns of botnets built out of ordinary consumer devices, and watched the same anxiety turn into trade policy when Washington moved against consumer routers made outside the US. The router keeps ending up at the center because it is the one device with a view of everything and an owner who never looks at it.
The honest summary
Reboot your router. It is free, it takes a minute, and there is a real class of infection it removes cleanly.
Then go one step further, because the campaign that triggered all this coverage was not a memory resident implant. It was a settings change, made once, that quietly persisted through every restart afterward. Open the admin page, look at what DNS servers your network is being told to use, update the firmware, and turn off remote access on the way out.
Ten minutes, once. Then set a reminder to check again in six months, which is roughly the interval at which someone publishes a new vulnerability for a router a lot of people are still running.
