FBI: Russian Hackers Hijacked Thousands of Routers

A unit of Russia's military intelligence directorate, known as APT28 or Fancy Bear, has been systematically compromising home and small office routers since at least 2024. The FBI and NSA revealed that these compromised devices were leveraged to intercept user credentials, authentication tokens, and sensitive communications. In response, federal agencies took the unprecedented step of remotely resetting thousands of affected U.S. routers under a court order.

The attack specifically targeted small-office/home-office (SOHO) routers, employing a Domain Name System hijacking operation. This method involved intercepting DNS requests by altering default network configurations, allowing attackers to view unencrypted user traffic. While the FBI noted the attack was ongoing as of April 7, 2026, and targeted a broad range of routers for intelligence gathering on military, government, and critical infrastructure, some experts suggest enterprise routers were the primary focus, potentially limiting risk to standard home Wi-Fi setups.

Security officials have identified specific TP-Link models, including the TP-Link TL-WR841N, as being among the targeted devices. A TP-Link spokesperson confirmed that many affected models have reached their End of Service and Life status. These routers likely no longer receive firmware updates, leaving networks vulnerable. Both the NSA and TP-Link are urging users to upgrade to newer, supported devices and to implement basic router hygiene, such as changing default credentials and updating firmware.