Home routers hijacked across several regions now form part of a large covert espionage network. Security researchers linked more than 50,000 compromised devices to an operation that uses outdated consumer routers to route malicious traffic and hide intelligence-gathering activities. The campaign demonstrates how threat actors exploit unsupported hardware to build long-term, persistent infrastructure.
Scale and structure of the espionage operation
Researchers uncovered a long-running campaign built on end-of-life routers. These devices remain active worldwide yet no longer receive essential security updates. Attackers targeted large clusters in Taiwan, Southeast Asia and parts of Europe and the United States.
Compromised devices used as relay nodes
The attackers repurposed the routers as encrypted relay points. Each device supported command-and-control activity or masked connections between threat actors and their targets. This structure allowed the operation to persist for months without significant disruption.
Exploited vulnerabilities and attack methods
The attackers relied on multiple known vulnerabilities within outdated firmware. These flaws included command-injection weaknesses, authentication bypasses and remote code execution vectors. Because the devices had reached end-of-life status, no patches existed to prevent exploitation.
Indicators reveal coordinated infrastructure
Investigators observed unusual elements across the compromised fleet. One consistent sign was a self-signed certificate with an extreme expiration window. This detail indicated structured planning and long-term intent rather than opportunistic attacks. The attackers also deployed consistent payloads across several models, which reinforced the conclusion of an organised campaign.
Why threat actors target consumer routers
Consumer routers often sit unmonitored for years. Many users never update firmware or replace unsupported hardware. Attackers exploit this behaviour and gain persistent access to networks without raising alarms.
Global distribution increases strategic value
Routers placed inside homes or small offices provide valuable geographic coverage. This reach allows attackers to route traffic through legitimate addresses and avoid detection. Compromised devices across multiple regions support espionage efforts that require diverse global infrastructure.
Impact on households and organisations
Hijacked routers pose risks to individuals and corporate networks. Attackers can use them to stage intrusions, relay stolen data or hide malicious activity. Remote workers also increase exposure because home hardware becomes part of a larger attack path.
Outdated equipment creates lasting vulnerabilities
Legacy routers cannot receive security fixes. Users who depend on such hardware remain exposed even when they apply strong password hygiene. Organisations with remote staff must evaluate household equipment and enforce stricter security policies.
Conclusion
Home routers hijacked in this suspected Chinese-linked campaign show how outdated consumer hardware can support large espionage efforts. Attackers exploit unsupported firmware, weak configurations and widespread deployment to build persistent global infrastructure. Users and organisations must replace obsolete routers, strengthen network controls and recognise the growing threat posed by everyday devices.
0 responses to “Home routers hijacked in large Chinese-linked espionage campaign”