FBI router warning: Chinese hackers hijacked old Cisco and Netgear routers
Updated October 8, 2026. First published June 2024.
In January 2024 the FBI removed Chinese state malware from hundreds of US home and small office routers. Most were old Cisco and Netgear models that no longer got security updates. The fix the FBI keeps repeating: replace any router that's past end of life, and turn off remote management.
- The hackers, called Volt Typhoon, hid their tracks behind ordinary home routers.
- The routers weren't singled out by brand. They were simply too old to get patches.
- Owners rarely notice. A hijacked router keeps working normally.
- Check your model's support status today. It takes five minutes.
What did the FBI actually warn about?
On January 31, 2024, the Justice Department announced that the FBI had wiped the "KV Botnet" malware from hundreds of US routers under a court order.1 The hackers behind it, known as Volt Typhoon, are backed by the Chinese government.
They used the hijacked routers as a disguise. Their attacks on US targets looked like they came from American homes, not from China. The same day, FBI Director Christopher Wray told Congress that Chinese hackers were targeting water plants, the power grid, pipelines and transportation.2
Why were old Cisco and Netgear routers targeted?
Because they were easy, not because of the brand. The Justice Department said most of the hijacked routers were Cisco and Netgear models that had reached "end of life."1 Their makers had stopped sending security fixes, so known holes stayed open forever.
The original version of this post told readers to "upgrade Netgear routers." That was too narrow. The real lesson covers every brand: a router that no longer gets updates is the risk.
Has it happened again since?
Yes. Home routers keep showing up in these cases.
- September 2024: the FBI took down a Chinese botnet called Raptor Train, run by a group known as Flax Typhoon. It had infected more than 260,000 routers, cameras and storage drives worldwide.4,5
- May 2025: the FBI warned that criminals were turning end-of-life routers into proxies they rent out to hide other crimes. Its advice: replace the router if you can.6
- March 2026: the FCC cited these Chinese router campaigns when it stopped approving new foreign-made consumer router models.7 Our guide to the FCC router rule explains what that means for the router you own.
How do I know if my router is end of life?
- Find the model. It's on the sticker on the bottom or back of the router.
- Search the maker's support page for that model and look for an "end of life" or "end of support" notice.
- Check the last firmware date. If the newest update is years old, treat the router as unsupported.
- Turn off remote management in the router's settings unless you truly need it. The FBI singles this out.6
- Change the admin password from the default to something long and unique.
If the router is past end of life, replace it. Our guide to switching routers covers what to look for.
What should I do if I think my router was hacked?
Signs include settings you didn't change, devices you don't recognize, or a slow connection you can't explain. Reboot it, update the firmware if any exists, and change the admin password.
If it's past end of life, replace it rather than trying to clean it. Report the incident to the FBI at ic3.gov.6
Where Rio fits
A hijacked router looks perfectly normal, so its owner rarely finds out. Rio holds every new device for your approval in the app and keeps gadgets in separate SecureRooms, so one weak device can't reach the rest. It's $199.99 with a year of Rio VPN and free app updates.
An unpatched router can work for a stranger while it still looks fine to you.
Rio replaces it with a router that holds every new device until you say yes.
See how to replace an old routerFrequently asked questions
Did the FBI tell people to replace Netgear routers?
Not exactly. The FBI's January 2024 action targeted old routers that no longer received security updates. Most were Cisco and Netgear models, but the problem was their age, not the brand. The FBI's broader advice is to replace any router that has reached end of life and to turn off remote management.
What is Volt Typhoon?
Volt Typhoon is a hacking group sponsored by the Chinese government. US agencies say it has broken into networks behind water, power, communications and transportation systems. It routed its attacks through hijacked US home and small office routers so they looked like ordinary American internet traffic.
Can I tell if my router is part of a botnet?
Usually not. Botnet malware is built to stay quiet, so the router keeps working as normal. Warning signs include changed settings, unexplained slowdowns and unknown devices. The safest move for an unsupported router is to replace it, not to try to clean it.
How old is too old for a router?
Age alone isn't the test. What matters is whether the maker still sends security updates for your exact model. Check the support page for an end-of-life notice and the date of the last firmware update. If updates stopped years ago, it's time to replace it.
Sources
- US Department of Justice, U.S. Government Disrupts Botnet People's Republic of China Used to Conceal Hacking of Critical Infrastructure, January 31, 2024. justice.gov
- FBI, Director Wray's Opening Statement to the House Select Committee on the CCP, January 31, 2024. fbi.gov
- CISA, NSA, FBI and partners, Advisory AA24-038A: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure, February 7, 2024. cisa.gov
- US Department of Justice, Court-Authorized Operation Disrupts Worldwide Botnet Used by People's Republic of China State-Sponsored Hackers, September 18, 2024. justice.gov
- BleepingComputer, Flax Typhoon hackers infect 260,000 routers, IP cameras with botnet malware, September 18, 2024. bleepingcomputer.com
- FBI Internet Crime Complaint Center, Cyber Criminal Proxy Services Exploiting End of Life Routers, May 7, 2025. ic3.gov
- FCC, Fact Sheet: FCC Updates Covered List to Include Foreign-Made Consumer Routers, March 23, 2026. fcc.gov (PDF)
