Surge in Malicious Scans for Outdated Routers

A surge in malicious scans for outdated routers is putting millions of devices at risk. Security researchers warn that hackers are increasingly targeting unsupported models from Cisco, Linksys, and Araknis, turning them into entry points for attacks.

Rising Threats to Old Routers

Eclypsium, a supply chain security firm, reported a sharp rise in scans aimed at routers that no longer receive updates. Attackers exploit flaws in Cisco Small Business RV devices, Linksys LRT models, and Araknis AN-300-RT-4L2W units. More than 2,200 compromised routers have already been identified by the Shadowserver Foundation.

These scans succeed because hackers use a wide range of tools. They combine newly discovered exploits with old vulnerabilities, some dating back over 15 years. This means even ancient weaknesses still create real dangers when devices remain online.

FBI Warnings and Malware Campaigns

The FBI has repeatedly warned that outdated routers remain prime targets for cybercriminals. Malware like TheMoon uses these devices to create proxy networks, masking illegal activity. Many of these routers were built before 2010 and rely on outdated protocols such as SNMP or Cisco Smart Install. With default settings often left unchanged, attackers find them easy to compromise.

Why It Matters

• Persistent danger: Unpatched routers remain weak spots in both home and corporate networks.
• Stealth attacks: Compromised routers can operate normally, hiding malicious activity from users.
• Supply chain risk: Even secure systems face exposure if outdated devices connect to the network.

How to Stay Protected

• Replace unsupported routers as soon as possible.
• Disable remote access features like SNMP and SMI.
• Update firmware on all active devices.
• Use strong, unique passwords instead of factory defaults.
• Monitor networks for suspicious activity or sudden configuration changes.

Conclusion

The surge in malicious scans for outdated routers shows how neglected infrastructure creates lasting risks. By retiring unsupported hardware, securing current devices, and monitoring networks, organizations and individuals can close these dangerous gaps before attackers exploit them.