Pumpkin Eclipse: how 600,000 home routers were destroyed in 72 hours
Updated October 8, 2026.
Between October 25 and 27, 2023, an unknown attacker wiped out an estimated 600,000 home routers on one US internet provider's network. Researchers named it Pumpkin Eclipse and traced it to Chalubo malware, but nobody has said who did it or why. Every damaged router had to be physically replaced.
- 49% of the provider's modems vanished from the internet in 72 hours.
- The provider was never named, but the outage matched Windstream's.
- Researchers think weak passwords or an exposed admin page let attackers in.
- Lumen doesn't believe a nation-state was behind it.
What was Pumpkin Eclipse?
Pumpkin Eclipse is the name Lumen's Black Lotus Labs gave a destructive attack on home routers just before Halloween 2023. Over 72 hours, routers on one provider's network stopped working for good.1
Lumen first put the toll at more than 600,000 routers. Its current report says hundreds of thousands.1, 2 Affected gateways showed a steady red light, and owners were told the whole unit had to be replaced.1
Which internet provider was hit?
The researchers didn't name it. The timing and symptoms matched a Windstream outage in the Midwest in late October 2023, when customers had to swap their routers to get back online.2
The damaged units were mainly ActionTec T3200 and T3260 gateways supplied by the provider. Sagemcom units were also reported.1, 2
How were 600,000 routers destroyed?
The attackers used Chalubo, an off-the-shelf piece of malware first spotted in 2018. It ran in memory to avoid detection, then pulled down code that overwrote the routers' software, leaving them dead.1, 2
Nobody knows exactly how the attackers got in. Lumen found no known flaws listed for the two ActionTec models, so it believes they likely "abused weak credentials or exploited an exposed administrative interface."1
The motive is still unknown. Lumen doesn't assess it as the work of a nation-state, and has "high confidence" the attack was deliberate.1
Could it happen to your router?
A wipe this big is rare, but the weak spots behind it are everywhere. Criminals keep hijacking home routers, mostly older models with known holes. The FBI's 2025 and 2026 warnings focus on routers that no longer get security updates.3, 4
For the bigger picture, read how botnets hijack home routers.
How to protect your router
- Change the default admin password to a long, random one.3
- Turn off remote management so the admin page isn't open to the internet.1, 3
- Install updates as soon as they're out.3
- Reboot regularly. Some malware lives only in memory.1
- Replace end-of-life routers. No updates means known holes stay open.3
Using your provider's gateway? You can usually add your own router behind it. Our router comparison covers what to look for.
Where Rio fits: Rio holds every new device for your OK and walls gadgets into their own SecureRooms, so you decide what joins your home network. See how to switch routers.
Your router is the one device every other device trusts.
Rio blocks any device you didn't approve and keeps gadgets walled off from your laptops and phones.
See how to replace your routerFrequently asked questions
What was the Pumpkin Eclipse attack?
Pumpkin Eclipse was a destructive malware attack from October 25 to 27, 2023, that permanently disabled an estimated 600,000 home routers on one US internet provider's network. Lumen's Black Lotus Labs named it, traced it to Chalubo malware, and said nearly half of the provider's modems went offline.
Was Windstream hacked in October 2023?
The researchers never named the provider. But the Pumpkin Eclipse attack matched a Windstream outage at the same time, when many customers' ActionTec routers died and had to be replaced. Neither the cause of entry nor the attacker has been publicly identified.
Can malware permanently brick a router?
Yes. In Pumpkin Eclipse, malware overwrote the routers' software, leaving them unable to start, so every affected unit had to be replaced. Strong admin passwords, no remote management, prompt updates and replacing end-of-life routers lower the risk of this and of quieter infections.
How did hackers get into the routers?
Nobody knows for sure. Lumen found no publicly known flaws for the main router models. It believes the attackers most likely abused weak login credentials or reached an admin page that was exposed to the internet. That's why changing default passwords and turning off remote management matter.
Sources
- Lumen Black Lotus Labs, The Pumpkin Eclipse, May 30, 2024. lumen.com
- BleepingComputer, Malware botnet bricked 600,000 routers in mysterious 2023 attack, May 30, 2024. bleepingcomputer.com
- FBI, Cyber Criminal Proxy Services Exploiting End of Life Routers, May 7, 2025. ic3.gov
- FBI, AVrecon Malware-Infected Routers Exploited as Residential Proxies by SocksEscort, March 12, 2026. ic3.gov (PDF)
