Is my router part of a botnet? How hackers hijack home routers
Updated October 8, 2026.
Botnets quietly hijack home routers, mostly old ones that no longer get security updates, and rent them to criminals as cover. You usually can't tell from the couch. The fix is simple: replace an end-of-life router, keep a supported one updated, turn off remote management and use a strong admin password.
- TheMoon botnet grew to over 40,000 hijacked devices in early 2024.
- In 2026 the FBI linked one proxy service to about 369,000 hacked devices.
- Old routers that no longer get updates are the main target.
- A VPN doesn't stop a router from being hijacked.
What is a botnet?
A botnet is a crowd of hacked devices that one criminal group controls. Routers, cameras and streaming boxes are favorites because they stay on all day and rarely get checked.
Once inside, attackers use your connection as a disguise. Their fraud, password guessing or attacks look like they come from your home address.1
What was TheMoon botnet?
TheMoon malware first appeared in 2014. In January and February 2024, researchers at Lumen's Black Lotus Labs watched it grow to over 40,000 bots in 88 countries.2
Most of those bots powered Faceless, a proxy service that lets criminals hide behind real home connections. In one March 2024 push, attackers hit over 6,000 ASUS routers in under 72 hours.2
In May 2025, the FBI warned that criminals were installing TheMoon variants on end-of-life routers to run proxy services.3
Are routers still being hijacked in 2026?
Yes. In March 2026, the FBI and European partners took down SocksEscort, a proxy service built on routers infected with AVrecon malware.4
The FBI says the malware targeted about 1,200 device models from brands including Cisco, D-Link, Netgear, TP-Link and Zyxel. Most were home and small office routers with known, unpatched flaws.4
Wondering about a specific brand? Read what the TP-Link ban means for your router.
Is my router part of a botnet?
Often there's no obvious sign. The FBI lists these common clues:3
- The router runs hot.
- Your connection drops or slows for no clear reason.
- Settings change that you don't recognize.
The biggest clue is age. If the maker no longer releases updates for your router, assume it's exposed.
How to keep your router out of a botnet
- Replace an end-of-life router. Check the maker's site for an end-of-life notice.3
- Install updates as soon as they're available.3
- Turn off remote management so the admin page isn't open online.3, 5
- Use a strong admin password, random and at least 16 characters.3
- Reboot the router regularly. Some malware lives only in memory.5
Is a VPN enough? No. A VPN encrypts your traffic, but it doesn't patch the router or close its admin page. Our router VPN guide explains what a VPN does and doesn't cover.
Where Rio fits: Rio holds every new device for your OK and walls gadgets into their own SecureRooms, so one hijacked camera can't reach your laptop. See how to switch routers.
An old router can work for criminals without you ever knowing.
Swap it for Rio, which blocks devices you didn't approve and walls off the rest.
See how to replace your routerFrequently asked questions
Can a home router be part of a botnet?
Yes, and it's one of the most common targets. Botnets like TheMoon and AVrecon infect routers through known flaws, weak passwords or exposed admin pages, then rent your connection to criminals. Older routers that no longer get security updates are at the highest risk, according to the FBI.
How do I know if my router has been hacked?
The FBI lists overheating, connection problems and settings you don't recognize as common signs. Many infections show no signs at all. If your router no longer gets updates, replace it. Otherwise, update it, change the admin password and turn off remote management.
Does rebooting a router remove malware?
Sometimes. Some router malware runs only in memory, so a reboot clears it, and Lumen researchers recommend regular reboots. But attackers can reinfect the router if the flaw is still there. Install updates, change the admin password, and replace the router if it no longer gets updates.
Does a VPN protect my router from botnets?
No. A VPN encrypts traffic between your device and the VPN server, which helps on public Wi-Fi. It doesn't patch the router, change a weak admin password or close an exposed admin page. Those steps, plus replacing old routers, are what keep botnets out.
Sources
- Lumen Black Lotus Labs, Classic Rock botnet: criminal proxy networks, May 9, 2025. lumen.com
- Lumen Black Lotus Labs, The darkside of TheMoon, 2024. lumen.com
- FBI, Cyber Criminal Proxy Services Exploiting End of Life Routers, May 7, 2025. ic3.gov
- FBI, AVrecon Malware-Infected Routers Exploited as Residential Proxies by SocksEscort, March 12, 2026. ic3.gov (PDF)
- Lumen Black Lotus Labs, The Pumpkin Eclipse, May 30, 2024. lumen.com
