The FBI just remotely reset thousands of home and small office routers and your TP-Link could be on the hitlist

Date:
Wed, 13 May 2026 15:05:00 +0000

Description:
The FBI obtained court-authorization to reset thousands of routers remotely, so they could kick lurking Russian hackers out of compromised networks

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter The FBI has remotely reset thousands of routers The Russian GRU had compromised end-of-life devices Routers that have been reset should be replaced, and network setting checked The FBI have remotely reset thousands of home and small office routers after releasing a joint press release detailing how Russia has been compromising devices.

Some brands of routers are known for lasting upwards of a decade, and while that's great for the consumer, the developers will often stop releasing updates to keep the router secure. This leaves them open to compromise by attackers, specifically Russias Main Directorate of the General Staff (GRU), tracked as APT28 or Fancy Bear, which has been snooping on unsecured routers since at least 2024, the FBI said . Latest Videos From You may like Russian hackers hitting TP-Link home routers to hijack internet traffic Why the US just banned foreign-made routers and what it means for you Why new FCC rules could leave millions stuck with outdated, insecure hardware Time to replace your router If your device is included in the list of compromised devices (listed below), and you have found that it has been reset, the FBI and NSA recommend that you replace your router as soon as possible.

The GRU could be snooping on unsecured routers to intercept sensitive
internet traffic, including credentials and authentication tokens that can be used to compromise personal and work accounts. In particular, GRU has been targeting routers belonging to workers in the military, government, and critical infrastructure industries.

The FBI, NSA, and co-sealing agencies encourage SOHO router users to change default usernames and passwords, disable remote management interfaces from
the Internet, update to latest firmware versions, and upgrade end-of-support devices. Users should also carefully consider certificate warnings in web browsers and email clients, the NSA said .

Additionally, the FBI and NSA recommended that employees use a VPN when accessing sensitive information. Those that suspect they may have been compromised by the GRU should contact their local FBI field office and file a complaint with the Internet Crime Complaint Center (IC3). Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get
all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting
your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

A press release published by the US Justice Department detailed that the FBI had created a series of commands that, with court-authorization, it could
send to compromised routers.

The commands were designed to collect evidence regarding the GRU actors activity, reset DNS settings (i.e., remove GRU DNS resolvers and force
routers to obtain legitimate DNS resolvers from their Internet Service Providers (ISP)), and to otherwise prevent the GRU actors from exploiting the original means of unauthorized access.

The Justice Department added that the operation did not interfere with the normal functions of the router, nor did it collect any legitimate user data. What to read next China-nexus cyber actors' are turning routers and IoT infrastructure into covert botnets 'at scale' NCSC, Five Eyes, and others warn of campaign involving Typhoon-designated groups FCC router ban begs the question: Do you know whats running in your network? FBI says its investigating claims its systems were compromised - wire taps and search warrants apparently hijacked

The full list of targeted routers includes: TP-Link TL-WR841N TP-Link LTE Wireless N Router MR6400 TP-Link Wireless Dual Band Gigabit Router Archer C5 TP-Link Wireless Dual Band Gigabit Router Archer C7 TP-Link Wireless Dual
Band Gigabit Router WDR3600 TP-Link Wireless Dual Band Gigabit Router WDR4300 TP-Link Wireless Dual Band Router WDR3500 TP-Link Wireless Lite N Router WR740N TP-Link Wireless Lite N Router WR740N/WR741ND TP-Link Wireless Lite N Router WR749N TP-Link Wireless N 3G/4G Router MR3420 TP-Link Wireless N
Access Point WA801ND TP-Link Wireless N Access Point WA901ND TP-Link Wireless N Gigabit Router WR1043ND TP-Link Wireless N Gigabit Router WR1045ND TP-Link Wireless N Router WR840N TP-Link Wireless N Router WR841HP TP-Link Wireless N Router WR841N TP-Link Wireless N Router WR841N/WR841ND TP-Link Wireless N Router WR842N TP-Link Wireless N Router WR842ND TP-Link Wireless N Router WR845N TP-Link Wireless N Router WR941ND TP-Link Wireless N Router WR945N The Justice Department included a list of remediations for all routers: Replace End-of-Life and End-of-Support routers; Upgrade to the latest available firmware; Verify the authenticity of DNS resolvers listed in router settings; and Review and implement firewall rules to prevent the unwanted exposure of remote management services. Operation Masquerade led by FBI Boston is the latest example of how were defending our homeland from Russias GRU which weaponized routers owned by unsuspecting Americans in more than 23 states to steal sensitive government, military, and critical infrastructure
information, said Special Agent in Charge Ted E. Docks of the FBIs Boston Field Office.

The FBI utilized cutting edge technology and leveraged our private sector and international partners to unmask this malicious activity and remediate routers. Now were asking everyone who has a router to secure it, update its firmware, and replace it if needed. By working together, we can guard against nefarious nation state actors trying to compromise our national security. Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/the-fbi-just-remotely-reset-thousands-o f-home-and-small-office-routers-and-your-tp-link-could-be-on-the-hitlist


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)