Hardware FixRecommendedDevice not working? Your driver may be the problemCheck updates for common hardware issues.Fix DriversOctober DealsAmazon USOctober deal check: compare before you payAmazon US: current deals, useful picks and tech finds.Check DealsSlow PC?RecommendedPC slow today? Run a repair scan before it gets worseResolve common Windows issues and optimize system performance.Scan Now×
Skip to content
World desk6 min

How Botnets Use Compromised Routers and IoT Devices for Cyberattacks

Compromised routers and IoT devices can launch DDoS attacks, relay traffic, or enable targeted network intrusions. Here is how botnets recruit devices and how to reduce exposure.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Botnets use compromised routers and internet-connected devices as remotely controlled tools—often without their owners noticing. Attackers may direct them to flood websites with traffic, relay activity through residential internet connections, or, in particular targeted operations, manipulate network settings to steal information. Keeping device software current, replacing unsupported equipment, and limiting remote access can reduce the risk.

What is a botnet?

A bot is an internet-connected device that an attacker has compromised and can control remotely. A botnet is the network of those devices. FBI/IC3 defines a botnet as “A network of Internet-connected devices compromised by malware that can be controlled remotely without the owners’ knowledge.” (FBI/IC3, June 5, 2025.)

As an Amazon Associate I earn from qualifying purchases.

Botnets are not limited to PCs. Routers, cameras, DVRs, streaming devices, projectors, digital picture frames, and other connected products have featured in government advisories and investigations. A device can be useful to an attacker even if it has little personal data: its internet connection, network position, or ability to run commands may be enough.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

How do attackers recruit routers and IoT devices?

There is no single infection route. Attackers look for devices they can reach and exploit, then install or activate software that lets them communicate with the attacker or receive instructions.

#1 Best Overall
Elebase USB to USB C Adapter for iPhone 18 Pro Max,USBC Car Charger Adapter | 4Pack Type C Female to A Male Cable Converter for Apple Duo 17 16 15 14 Plus,iWatch Watch 12 11 10,iPad 9 8 Air,Airpods 5 4
  • Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
  • Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
  • Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
  • Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
  • 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
  • Default or weak passwords: Devices that retain factory credentials or use easily guessed passwords may be accessible to attackers.
  • Known vulnerabilities: A flaw in outdated software or firmware can provide a way in, especially when the device is exposed to the internet.
  • Exposed services: Open ports and remote-management services can make a device reachable. A compromised router may also scan for other exposed devices.
  • End-of-life software: Unsupported devices may no longer receive security fixes for newly discovered or known flaws.
  • Malicious software during setup: Some devices may be compromised before sale or through apps installed from unofficial marketplaces. FBI/IC3 identified both pathways in its BADBOX 2.0 advisory.

After gaining access, malware may establish remote control or contact command-and-control (C2) infrastructure. The device can then receive instructions, scan for additional vulnerable devices, or relay traffic. The FBI’s account of TheMoon describes malware scanning for open ports and sending commands to vulnerable scripts; a C2 server can direct infected routers to scan for more routers. Other campaigns use different techniques and infrastructure, so this is one example rather than a universal botnet design (FBI, May 7, 2025).

What can a botnet do with a compromised device?

Launch distributed denial-of-service attacks

In a distributed denial-of-service (DDoS) attack, many devices send traffic at a target to disrupt service or make a website or network resource unavailable. FBI/IC3’s account of the 2016 Mirai campaign describes infected routers, cameras, and DVRs used for DDoS after attackers exploited internet-accessible devices with common default usernames and passwords. The advisory is historical, but it illustrates how ordinary connected devices can be assembled into an attack force (FBI/IC3, October 17, 2017).

Rank #2
Sale
Anker USB-C Hub, 5-in-1 USB Hub for Laptops, 4K HDMI Multiport Adapter
  • 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
  • 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
  • Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
  • 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
  • What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.

Relay traffic through residential connections

A compromised home device can act as a proxy: it relays someone else’s traffic, making it appear to come from the home network’s residential IP address rather than the operator’s own connection. The FBI says criminal proxy services using TheMoon exploit end-of-life routers to hide actors’ identities and locations (FBI, May 7, 2025). FBI/IC3 also says BADBOX 2.0 devices maintain backdoors to proxy services using compromised home networks (FBI/IC3, June 5, 2025).

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Manipulate DNS or steal information in targeted operations

In a specific espionage operation, the U.S. Department of Justice said Russian military intelligence actors exploited vulnerabilities in TP-Link routers, stole credentials for thousands of routers worldwide since at least 2024, and changed some routers’ DNS settings to redirect requests to malicious resolvers. Fraudulent DNS records for selected domains enabled actor-in-the-middle attacks, allowing the actors to harvest unencrypted passwords, authentication tokens, emails, and other sensitive information from devices on the same network (DOJ, April 7, 2026). This describes a particular campaign, not what every botnet does.

Rank #3
Sale
Anker USB C Hub, 7in1 Multi-Port USB Adapter, 4K@60Hz USBC to HDMI Splitter
  • Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
  • Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
  • Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
  • Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
  • What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.

Provide a foothold for further compromise

Compromised routers and other network devices can help attackers reach targeted networks or other devices and information on a private network. A joint advisory from the FBI, the U.S. Cyber National Mission Force, the NSA, and allied partners described PRC-linked actors compromising thousands of SOHO routers, firewalls, network-attached storage systems, and IoT devices. The advisory said these devices were used as proxy infrastructure and for DDoS or to compromise targeted networks; it also described Mirai-family malware (joint advisory, September 18, 2024).

Examples show different devices and different scales

These cases are evidence of specific campaigns, not a count of all infected devices. Their numbers should not be combined into a global botnet estimate.

Rank #4
Sale
UGREEN USB to USB C Adapter Combo 4-Pack, 10Gbps USB C Converter Space Gray
  • Dual Converters, Infinite Potential:Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
  • Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
  • Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
  • Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
  • Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Example What the cited agency reported
Mirai, 2016 campaign FBI/IC3’s 2017 advisory describes routers, cameras, and DVRs infected for DDoS using common default credentials.
TheMoon The FBI says the malware was first identified on compromised routers in 2014 and describes later campaigns using end-of-life routers for proxy services. Its 2025 alert explains scanning and C2-directed activity.
BADBOX 2.0 FBI/IC3 said in 2025 that this botnet consisted of millions of infected devices, including streaming devices, digital projectors, aftermarket vehicle infotainment systems, and digital picture frames. Devices could be compromised before purchase or via malicious apps during setup.
GRU router operation DOJ said in 2026 that actors stole credentials for thousands of TP-Link routers worldwide since at least 2024 and manipulated DNS settings on some routers.

There is no current global count of all botnet-infected routers or IoT devices established by these cited government sources. The figures above apply only to the named campaigns.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

How to reduce the risk to your router and IoT devices

1. Check whether the router is still supported

Look up the exact model and hardware revision on the manufacturer’s official support site. Confirm that it still receives firmware or security updates. End-of-life equipment is no longer actively supported, and its manufacturer may no longer issue patches. The FBI warned that routers dated 2010 or earlier likely no longer receive manufacturer software updates and could be vulnerable to known flaws (FBI, May 7, 2025). That date is a warning indicator, not a substitute for checking support for your particular model. Replace a router that has reached end of support.

Best Value
Sale
Anker USB C Hub, 5-in-1 USBC to HDMI Splitter with 4K Display | 85W Max PD, 1 Powered USB-C 5Gbps & 2 Powered USB-A 3.0 5Gbps Data Ports, for MacBook Pro, MacBook Air, Dell and More (Black)
  • 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
  • Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
  • Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
  • HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
  • What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.

2. Install firmware and security updates

Use the manufacturer’s update process and check periodically for new firmware. If the router offers automatic updates, enable them when appropriate. Apply updates to IoT devices too; a secure router does not fix outdated software on a camera, streaming box, or other connected product.

3. Use unique credentials and limit remote access

  • Replace default router and IoT-device usernames and passwords wherever the device allows it. Use a unique, strong router password; the FBI’s 2025 alert specifies a random password between 16 and 64 characters.
  • Disable remote administration if you do not need to manage the router from outside your home or office.
  • Review firewall rules and remove unnecessary exposure of remote-management services. Turn off port forwarding when it is not required.

4. Review connected devices and their apps

Check the router’s device list for products you do not recognize, and review unexpected network activity. Disconnect a suspicious device while you investigate. Avoid unofficial app marketplaces, especially when an app or product is promoted as an unlocked device or as a way to get free streaming. FBI/IC3 lists these as potential BADBOX 2.0 warning signs; an indicator alone does not prove that a device is infected (FBI/IC3, June 5, 2025).

5. Isolate IoT devices where practical

If your router supports a guest or separate IoT network, place less-trusted connected devices there rather than on the same network as computers containing sensitive information. This can limit the routes available between devices if one is compromised. Older FBI/IC3 guidance also recommends isolating IoT devices and disabling port forwarding when it is not needed (FBI/IC3, October 17, 2017).

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What to do if you suspect a router or IoT device is compromised

Unexplained traffic or changed settings deserve investigation, but they are not proof of a botnet infection. A slow connection or a warm router on its own is not enough to diagnose compromise.

  1. Disconnect a suspicious device if feasible. This can stop its network activity while you review it, though it may interrupt service.
  2. Check router settings and connected devices. Look for unfamiliar devices, unexpected DNS settings, enabled remote administration, or firewall and port-forwarding rules you did not create.
  3. Update firmware and change credentials. Use the manufacturer’s official instructions. Change router and device passwords, and avoid reusing a password from another account.
  4. Reboot or reset only as appropriate. Follow the manufacturer’s remediation guidance. A reboot may not remove malware, and a factory reset can erase settings; consult official support for device-specific steps.
  5. Report suspected criminal activity. FBI/IC3 directs people to report through IC3 or contact the FBI. Preserve useful details such as device model, dates, and unusual settings or activity.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
Outdated Drivers Are Slowing You DownFree scan - exact matches
PC Slower Than It Used to Be?Free scan - under a minute

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.