Get the latest tech news

Hackers backed by Russia and China are infecting SOHO routers like yours, FBI warns

Six years on, routers remain a favorite post for concealing malicious activities.

The operation, which received prior court authorization, went on to add firewall rules that would prevent APT28—also tracked under names including Sofacy Group, Forest Blizzard, Pawn Storm, Fancy Bear, and Sednit—from being able to regain control of the devices. Perform a hardware factory reset to remove all malicious files Upgrade to the latest firmware version Change any default usernames and passwords Implement firewall rules to restrict outside access to remote management services. Tuesday’s advisory said that APT28 has been using the infected routers since at least 2022 to facilitate covert operations against governments, militaries, and organizations around the world, including in the Czech Republic, Italy, Lithuania, Jordan, Montenegro, Poland, Slovakia, Turkey, Ukraine, the United Arab Emirates, and the US.

Get the Android app