FBI warns outdated routers are being exploited as covert proxy nodes by cybercriminals

The FBI has issued alerts warning that unsupported home routers are being targeted by hackers, who use them to conceal malicious traffic and build residential proxy networks for illicit purposes, raising risks for households and small businesses.

Old routers do not always end up as harmless spare parts. According to the FBI, end-of-life networking gear is now being actively targeted by cyber criminals who exploit unpatched flaws and turn compromised devices into residential proxy nodes. In practice, that means an ageing router sitting on a home network can be repurposed to hide malicious traffic behind a legitimate residential IP address.

The FBI warned on 7 May 2025 that unsupported routers are especially exposed because manufacturers no longer provide security fixes. The bureau said attackers have used variants of TheMoon malware to compromise such devices, then folded them into proxy infrastructure for illicit activity. TechRadar and GovTech reported at the time that the same abused hardware is also being used in botnets, allowing criminals to rent access and route attacks through home connections.

A separate FBI notice published on 12 March 2026 sharpened that warning by focusing on residential proxy networks more broadly. The bureau said threat actors use home and small business internet connections to obscure where they are operating from, making abuse harder to detect and block. An accompanying FLASH report said AVrecon malware has been observed infecting routers and internet-connected devices and selling access to them through the SocksEscort residential proxy service.

For households, the risk is not abstract. A compromised router can slow connections, consume data allowance and create the false impression that suspicious traffic came from the home owner’s line. The FBI recommends replacing unsupported routers, applying any available security updates, disabling remote management and using strong, unique passwords. XDA Developers’ advice to audit ageing hardware is sound: if a router no longer receives security patches, it should not remain on the edge of the network.