FBI Warns Consumers to Replace Outdated Routers Hijacked by TheMoon Malware

 

The FBI has issued an urgent warning to American consumers and businesses: replace outdated internet routers immediately or risk becoming an unwitting accomplice in cybercrime. According to the agency, cybercriminals are actively targeting “end-of-life” routers—older models that no longer receive security updates from manufacturers—and infecting them with a sophisticated variant of TheMoon malware. Once compromised, these routers are hijacked and repurposed as proxy servers that enable criminals to mask their identities while conducting illegal activities online. 

These include financial fraud, dark web transactions, and cyberattacks, all executed through unsuspecting users’ networks. Because these routers lack updated firmware and security patches, they are especially vulnerable to remote infiltration and control. TheMoon malware, which first emerged in 2014, has evolved into a more potent threat. It now scans for open ports and installs itself without requiring a password. Once embedded, it silently operates in the background, routing illicit activity and potentially spreading to other devices within the network. The malware’s stealthy behavior often leaves users unaware that their home or business network has become part of a criminal infrastructure. 

The FBI specifically warned that routers manufactured in 2010 or earlier are particularly at risk—especially if features like remote administration are still enabled. Older Linksys models such as E1200, E2500, E1000, E4200, E1500, E300, E3200, WRT320N, E1550, WRT610N, E100, M10, and WRT310N are listed among the most vulnerable devices. Signs of a compromised router may include overheating, unexplained changes to settings, or erratic internet connectivity. In many cases, users may not even realize their equipment is outdated, making them easy targets for attackers seeking anonymous access to the web. 

To defend against these threats, the FBI strongly advises replacing unsupported routers with modern, secure models. Users should also disable remote access functions, install the latest security patches, and use complex, unique passwords to further protect their networks. If anyone suspects their router has been hijacked or detects suspicious activity, they are encouraged to file a report with the FBI’s Internet Crime Complaint Center (IC3). 

As cybercriminals become more innovative, relying on outdated technology increases exposure to serious digital threats. This latest alert is a stark reminder that cybersecurity begins at home—and that even something as common as a router can become a gateway for criminal exploitation if not properly secured.