In the new alert, federal agents said criminals are targeting “end of life” routers—older models no longer supported by manufacturers with security updates—and infecting them with a variant of TheMoon malware. The infected devices are then used as proxy servers, allowing criminals to mask their real locations while committing online crimes ranging from financial theft to illegal transactions on the dark web, the FBI said.
The FBI explained that many old Internet routers are no longer supported by their manufacturers, which means the routers don’t get security updates anymore. Once they get in, hackers install harmful software that lets them take control of the router, the FBI warned.
The hackers use the hijacked routers in different ways—such as launching cyber attacks or selling access to them through services like 5Socks and Anyproxy, the FBI said. This allows others to use the routers to hide their identity online or do illegal things without getting caught.
TheMoon malware, first detected in 2014, has evolved in recent years, the FBI said, and added that it now scans for open ports on vulnerable routers and installs itself without needing a password. Once inside, the malware can spread to other systems and remain hidden while passing on illegal activity back and forth—leaving people unaware their network has been turned into a digital accomplice, the FBI said.
The FBI said routers produced in 2010 or earlier are really vulnerable, especially if remote administration is enabled. Many users may not realize their devices are outdated or don’t have the firmware protections, making them easy targets.
Warning signs that a router may be infected include overheating, unusual settings changes, or spotty Internet connectivity, the FBI said.
The following router models are especially at risk of being taken over:
E1200, E2500, E1000, E4200, E1500, E300, E3200, WRT320N, E1550, WRT610N, E100, M10 and WRT310N.
The FBI is urging consumers and businesses to replace unsupported routers with newer models, disable remote access features, install all security patches and use strong, special passwords. If you believe your router may be affected, report suspicious activity to the FBI’s Internet Crime Complaint Center.
©2025 Advance Local Media LLC., Distributed by Tribune Content Agency, LLC.
