Your Home Router Might Be Working for Someone Else: Inside the New Proxy Botnets
CISA warns that state-sponsored hackers are quietly compromising residential routers to build proxy networks for espionage — and most owners will never notice.
The U.S. Cybersecurity and Infrastructure Security Agency has issued an alert that should make every household pause: state-sponsored actors, including Russian-linked groups, are compromising ordinary home routers at scale and knitting them into proxy networks used to hide espionage traffic and stage potential attacks on infrastructure.
The victim experience is what makes this campaign dangerous — there isn't one. A hijacked router keeps serving Netflix and video calls normally while quietly relaying someone else's traffic in the background.
Why routers, and why now
Routers are the perfect foothold: always on, rarely updated, and sitting outside the protection of antivirus software. Traffic that exits from a residential IP address looks legitimate to most security systems, which is exactly why attackers now prize these devices over traditional servers.
How to protect yourself in five minutes
Update your router firmware today, then disable remote administration. Change the admin password — not just the Wi-Fi password. If your device is more than five or six years old and no longer receives updates, replace it; an unsupported router is a permanent open door. Businesses should go further and put employee home networks in their threat model, because the corporate perimeter now runs through living rooms.
The uncomfortable truth of 2026: the cheapest piece of hardware in your house has become part of the geopolitical attack surface.
