NSA/FBI Router Warning Explained: Are Russian Hackers Really Targeting Your Home Router?

Yes, Russian military intelligence really did compromise home and small-office routers. No, the evidence does not show that most American families are currently being singled out by Russian hackers, and simply rebooting your router is not a complete fix.

The FBI and NSA warning was legitimate. Russia’s GRU military intelligence service exploited vulnerable routers, changed their Domain Name System settings and used the resulting access to look for people and organizations of intelligence interest. The FBI said compromised routers were found in more than 23 U.S. states.^[1][2]

But a much scarier version has been circulating online: Russian hackers are supposedly sweeping through American homes, looking specifically for families with default passwords, old firmware and routers that have not been rebooted recently. The suggested solution is often presented as a five-minute emergency fix: reboot, update and change the password.

Several pieces of that advice are good cybersecurity practice. The framing is much less accurate.

The actual story is both more technical and, for an ordinary household with reasonably current equipment, considerably less frightening.

What did the FBI and NSA actually warn about?

On April 7, 2026, the FBI, NSA and international partners warned that Russia’s GRU 85th Main Special Service Center, also known as APT28, Fancy Bear or Forest Blizzard, had been exploiting vulnerable small-office/home-office routers around the world.^[1:1]

This was not a theoretical vulnerability.

The attackers had actually compromised routers and modified their settings so that devices connected to them could be directed to DNS servers controlled by Russian intelligence.^[1:2][3]

The Department of Justice simultaneously announced Operation Masquerade, a court-authorized FBI operation that disrupted the U.S. portion of the infrastructure. The FBI sent commands to compromised American routers that removed the GRU-controlled DNS settings and made other changes intended to block the attackers’ original method of access.^[2:1]

That detail matters.

The government’s announcement was not simply: "Russian hackers have discovered American routers. Everybody unplug yours immediately."

It was also an announcement that law enforcement had identified and actively disrupted part of the operation.

What were the Russian hackers trying to do?

The easiest way to understand the attack is to think of DNS as the internet’s address book.

When you type a name such as outlook.com, your device needs to determine which internet address it should connect to. A DNS resolver performs that lookup.

Normally, your router tells phones, laptops and other devices on the network which DNS servers to use. It commonly does this through another networking system called DHCP.

APT28 compromised routers and changed those DHCP/DNS settings so connected devices were instead told to use DNS servers controlled by the attackers.^[3:1][4]

That gave the GRU an unusually useful position.

It did not automatically mean the Russians could read everything everybody did online.

Most DNS requests were apparently handled normally. The malicious servers could observe the domain lookups, but for most destinations they simply returned the legitimate address. For selected domains and users, however, the attackers could return a false address and redirect the connection toward infrastructure they controlled.^[3:2][4:1]

In other words, imagine secretly replacing a town’s directory-assistance operator. Most callers still receive the correct number. But when a particularly interesting person asks for a particular office, the operator gives them a different number.

Didn’t HTTPS encryption prevent this?

This is one of the most important details missing from many simplified warnings.

Taking control of DNS does not automatically defeat HTTPS encryption.

Modern websites use TLS, the encryption system behind HTTPS. If an attacker redirects you to a server pretending to be Microsoft but that server cannot prove that it really is Microsoft, your browser or application is supposed to reject the connection or display a certificate warning.

Microsoft observed exactly that problem for the attackers.

In the more aggressive part of the campaign, Forest Blizzard returned fraudulent DNS answers for selected targets and attempted an adversary-in-the-middle attack. The attacker-controlled server presented an invalid TLS certificate. If the user or software rejected it, the encryption system did its job. If the warning was bypassed or certificate validation otherwise failed, the attacker could potentially intercept information that would normally be encrypted.^[4:2]

That included passwords, emails and authentication tokens in observed attacks.^[1:3][4:3]

So the attack was serious.

But "they changed the DNS server" is not the same as "they could silently read every encrypted website visited by every household."

There were still additional security barriers.

Why authentication tokens matter

Passwords were not the only prize.

Investigators also observed efforts to capture authentication or OAuth tokens.^[1:4][3:3]

An authentication token is essentially proof that a service has already authenticated you. After you sign in, a service may issue one so that you do not have to enter your password and verification code for every subsequent request.

If an attacker steals the right session token, traditional multifactor authentication does not necessarily save that already-authenticated session.

That is one reason security agencies increasingly recommend phishing-resistant login methods such as passkeys and FIDO security keys for sensitive accounts. They bind the authentication process to the legitimate website much more tightly than ordinary passwords or one-time codes.^[5]

For the average household, this does not mean you need to overhaul every account tonight. It does mean that passkeys are worth enabling when major email, financial and work accounts offer them.

Were the hackers deliberately targeting ordinary American families?

This requires an important distinction.

The router compromises were broad and opportunistic. The subsequent espionage targeting was much more selective.

The UK National Cyber Security Centre concluded that APT28 appeared to compromise a large pool of vulnerable routers first and then filter users at later stages according to potential intelligence value.^[3:4]

The FBI similarly described the initial router targeting as indiscriminate, followed by an automated process identifying DNS requests worth intercepting. The ultimate targets included military, government and critical-infrastructure interests.^[2:2]

Microsoft observed follow-on interception affecting sectors including government, information technology, telecommunications and energy.^[4:4]

So an ordinary person’s router could certainly become part of the infrastructure.

That does not mean Russian military intelligence had specifically chosen that person’s family for surveillance.

A compromised home router can be valuable because of what passes through it, who uses it for remote work, or simply because it provides infrastructure that an attacker can exploit.

The router can be a target without the family being the ultimate target.

Were they looking for "non-tech-savvy families"?

There is a grain of truth underneath that wording, but it overstates what investigators found.

Attackers generally prefer vulnerabilities that are cheap and easy to exploit. Unsupported routers, known vulnerabilities, exposed management interfaces and weak credentials all reduce the amount of work necessary to compromise a device.

But the technical reports do not describe a campaign in which Russian intelligence somehow classified American households as tech-savvy or non-tech-savvy and then hunted the latter.

The evidence instead shows opportunistic exploitation of vulnerable equipment, followed by selective intelligence targeting.^[3:5][6]

Those are different claims.

Were factory-default passwords the main problem?

Changing a router’s default administrator credentials is good advice, and the FBI included that recommendation.^[1:5]

But default passwords do not fully explain this particular campaign.

One important vulnerability associated with the operation, CVE-2023-50224, could expose stored credentials on certain TP-Link devices without the attacker first authenticating normally. The NCSC reported that APT28 could obtain router credentials through specially crafted requests and then use further requests to change the router’s DHCP/DNS configuration.^[3:6]

So "change your default password" is useful general security advice.

It should not be mistaken for a complete explanation of how these routers were compromised.

How many routers were actually affected?

There is no credible evidence that "most homes in America" were compromised.

The available telemetry gives several numbers, and they should not be treated as interchangeable.

Microsoft said it identified more than 5,000 consumer devices and more than 200 organizations affected by Forest Blizzard’s malicious DNS infrastructure.^[4:5]

Lumen’s Black Lotus Labs had broader network visibility. During a December 2025-to-January 2026 measurement window, it observed roughly 290,000 distinct IP addresses making at least one request to attacker-controlled DNS servers. Applying stricter criteria reduced that figure to about 40,000 low-confidence victims and approximately 18,000 moderate-confidence victims.^[6:1]

Those figures do not mean 290,000 confirmed hacked households.

An IP address is not necessarily one person, one household or one router. Telemetry from different companies also uses different visibility, thresholds and definitions.

What the data establish is that the operation was significant and international.

They do not establish that most American homes were compromised or even vulnerable to this particular attack.

Which routers were involved?

Investigators identified TP-Link and MikroTik devices among the compromised equipment, with TP-Link routers particularly prominent in the U.S. government disclosures.^[2:3][6:2]

TP-Link subsequently published an affected-device advisory for CVE-2023-50224.

The most reassuring detail for owners of newer equipment is that the affected list is heavily concentrated in legacy hardware. TP-Link said nearly all products on its affected list had already reached end-of-life or end-of-service status. Some models received patches; many older models could not be patched and were recommended for replacement.^[7]

This is why the relevant question is not:

Do I own a router?

It is:

Do I own a vulnerable or unsupported router?

The exact hardware version matters. Two routers with similar model names can use different hardware and firmware.

If you own a TP-Link router, use the manufacturer’s current CVE-2023-50224 advisory rather than a social-media list.

Does rebooting your router protect you?

Rebooting is legitimate security advice. It just is not a magic fix for this attack.

This point has become muddled because two different pieces of NSA guidance are being combined.

Back in February 2023, long before this particular GRU campaign was disclosed, NSA published general home-network security recommendations. Among them was advice to reboot routers, computers and smartphones at least weekly because some malicious implants live only in volatile memory and disappear when the device restarts.^[8]

That advice is real.

But a non-persistent malware implant and a malicious router configuration are not the same thing.

The 2026 APT28 campaign involved changes to router DNS settings. Restarting a router does not inherently patch vulnerable firmware, make obsolete hardware supported again, undo a persistent configuration change or recover credentials that an attacker already stole.

That is why the April 2026 FBI advisory emphasizes different actions:

• replace unsupported routers;
• install current firmware;
• change default administrative credentials;
• disable internet-facing remote management; and
• pay attention to certificate warnings.^[1:6]

The DOJ went further and recommended verifying that the DNS resolvers configured in the router are legitimate.^[2:4]

A reboot can still be part of healthy maintenance. It simply should not be sold as though powering a router off and back on ejects the GRU and closes the vulnerability.

What should a normal American household actually do?

For most people, this does not require a cybersecurity course.

1. Find your router’s exact model and hardware version

Look at the label on the router or gateway.

If your internet provider supplied it, identify the model but generally use the provider’s update or replacement process rather than installing firmware yourself.

2. Check whether the router is still supported

This is arguably more important than when you last rebooted it.

If the manufacturer no longer provides security updates, replacing the device is the safest long-term answer.

An internet-connected security appliance that can no longer receive security fixes becomes progressively harder to defend as new vulnerabilities emerge.

3. Install the latest official firmware

Use the router manufacturer’s official support site or your ISP’s update mechanism.

Some modern routers update automatically. Many older devices do not.

TP-Link specifically noted that the legacy models covered by its 2026 advisory do not support automatic firmware updates, meaning any available fixes must be installed manually.^[7:1]

4. Change the router administrator password

Do not confuse this with your Wi-Fi password.

The Wi-Fi password controls who can join the wireless network.

The router administrator password controls who can change the router itself.

Use a unique administrator password that you have not reused elsewhere.

5. Turn off internet-facing remote administration unless you need it

Most home users have no reason to administer their router from somewhere across the internet.

Both current and longstanding government guidance recommend restricting router management to the internal network when possible.^[1:7][8:1]

6. Check the DNS settings if you are concerned

Most consumers either use DNS settings supplied automatically by their ISP or deliberately use a service they recognize.

If your router suddenly contains manually configured DNS servers you did not set and do not recognize, do not randomly change settings based on a social-media post. Check the router manufacturer’s documentation or contact your ISP.

7. Do not ignore certificate warnings

This campaign is an unusually good example of why browser certificate warnings matter.

If a familiar email or login page suddenly reports that its security certificate cannot be trusted, do not click through the warning just because the site looks familiar.

That warning may be the security mechanism preventing an adversary-in-the-middle attack.^[1:8][4:6]

8. Use stronger account authentication when available

Turn on multifactor authentication for important accounts.

For services that offer them, passkeys or other FIDO-based authentication provide stronger protection against phishing and adversary-in-the-middle attacks than passwords and ordinary one-time codes.^[5:1]

What if your internet company supplied the router?

This is another reason generic "fix your router in five minutes" advice can be misleading.

Millions of Americans use gateways provided and managed by Comcast, Spectrum, AT&T, Verizon or other internet providers.

Those devices may receive firmware automatically from the provider.

If the device belongs to your ISP, the most useful questions are:

• Is my gateway model still supported?
• Is its firmware current?
• Has my provider identified it as affected?
• Can I exchange an older unit for a newer supported model?

You generally should not install firmware downloaded from random websites or attempt unsupported modifications to provider-managed equipment.

If your ISP says the gateway is current and automatically maintained, you are in a very different position from someone running a decade-old personally owned router that has not received a security patch in years.

What if you think your router was actually compromised?

First fix the router itself.

That may mean installing updated firmware, replacing unsupported hardware, correcting its configuration or following your ISP or manufacturer’s reset procedure.

Then address the accounts that may have been exposed.

Microsoft specifically warns that correcting the DNS configuration does not undo credentials already stolen during a successful adversary-in-the-middle attack.^[4:7]

For accounts you believe could have been exposed:

• change the password after the network problem has been corrected;
• sign out or revoke existing sessions where the service offers that option;
• review recent account activity;
• enable stronger authentication.

If the FBI or your ISP directly notified you that your router was part of the disrupted infrastructure, take that notification seriously. The FBI said it was working with internet providers to notify affected U.S. users.^[2:5]

There was another Russian router warning in July

This has caused additional confusion.

On July 13, 2026, NSA and international partners issued another warning about Russian exploitation of networking devices.^[9]

But it described a different Russian intelligence organization and a different emphasis.

The July advisory concerned Russia’s Federal Security Service, or FSB, Center 16 and ongoing exploitation of poorly configured networking equipment associated with sectors such as defense, communications, energy, financial services, government and healthcare.^[9:1]

Its recommendations included measures involving enterprise networking technologies such as SNMPv3, Cisco Smart Install, TFTP and firewall configuration.

That warning reinforces the broader lesson that routers and other edge devices are attractive targets for Russian state hackers.

It does not transform the April GRU operation into evidence that every household router in America is currently under active Russian attack.

So was the warning alarmist?

The underlying government warning was not alarmist. It described a real Russian military intelligence operation with real victims.

The exaggeration happens when several different facts are compressed into a much scarier story:

True: Russian military hackers compromised home and small-office routers.

True: Unpatched and unsupported routers are easier to exploit.

True: Changing default credentials is sensible.

True: NSA has separately recommended periodic router reboots.

Not established: Russian intelligence is specifically hunting "non-tech-savvy families."

Not established: Most American homes are vulnerable to this campaign.

Misleading: A reboot by itself fixes the underlying vulnerability.

That distinction matters because cybersecurity warnings work best when people understand what the actual risk is.

Fear without precision can produce the wrong response: someone reboots an obsolete router, feels protected and continues running hardware that has not received security updates in years.

Do you need to buy a guide or security service?

No paid guide is required to perform the steps recommended by the FBI, NSA, router manufacturers and security researchers.

Their relevant instructions are publicly available.

A commercial guide may organize those instructions or make them more convenient, but there is no proprietary five-minute defense that ordinary consumers need to purchase to protect themselves from this campaign.

The important actions are relatively boring: maintain supported equipment, install updates, protect the administrator account, restrict remote management and take security warnings seriously.

That is less dramatic than "Russian hackers are coming for your family’s router."

It is also much closer to what the evidence actually says.

The bottom line

Russian intelligence targeting routers is real, and it deserves attention.

APT28 compromised thousands of vulnerable devices and used malicious DNS infrastructure to identify and, in selected cases, intercept targets of intelligence value. The FBI considered the operation serious enough to obtain court authorization to modify compromised routers inside the United States.^[2:6]

But the evidence does not justify panic.

If your router is current, supported, patched, protected by a unique administrator password and not exposing its management interface to the internet, you have already addressed the major consumer risks identified in the warning.

If your router is old enough that you cannot remember when it last received a security update, checking its support status matters considerably more than unplugging it for 30 seconds.

Reboot it if you want. NSA considers periodic reboots worthwhile security hygiene.

Just do not mistake restarting a vulnerable router for securing one.

References and Further Reading

Primary U.S. government records

FBI/IC3: Russian GRU Exploiting Vulnerable Routers to Steal Sensitive Information The central April 7 public warning. It describes the documented DNS-hijacking attack and gives the government’s consumer and network-defender recommendations.

Department of Justice: Operation Masquerade DNS-Hijacking Disruption Explains the FBI’s court-authorized operation, what was changed on compromised U.S. routers, the more-than-23-state scope, and the government’s recommended remediation.

NSA: Best Practices for Securing Your Home Network The 2023 guidance containing NSA’s recommendation for periodic and at-least-weekly device reboots. This is important because that older general recommendation is frequently blended into coverage of the 2026 GRU campaign.

NSA: Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting The separate July 2026 warning involving FSB Center 16 and critical-infrastructure networking equipment. Useful for distinguishing the two Russian campaigns.

Technical attack analysis

UK NCSC: APT28 Exploit Routers to Enable DNS Hijacking Operations The clearest government-level technical description of the attack chain, including exploitation of TP-Link equipment, changes to DHCP/DNS settings and subsequent selective adversary-in-the-middle activity.

Microsoft Threat Intelligence: SOHO Router Compromise Leads to DNS Hijacking and Adversary-in-the-Middle Attacks Provides telemetry, explains why the malicious DNS servers often behaved normally, and details how invalid TLS certificates limited the attackers’ ability to silently intercept encrypted connections.

Lumen Black Lotus Labs: FrostArmada Provides the broadest public telemetry and a detailed reconstruction of the router exploitation, DNS infrastructure and authentication-targeting process.

Router-specific guidance

TP-Link: CVE-2023-50224 Affected Products and Fixes The manufacturer’s current affected-model list, hardware versions, patch status and recommendations. Particularly useful for readers trying to determine whether a specific TP-Link device is affected.

Authentication

CISA: More Than a Password Explains the difference between ordinary MFA and phishing-resistant authentication such as FIDO/WebAuthn.

Editorial currency note: Router firmware, affected-product lists and vendor support status can change. Readers checking a specific device should use the manufacturer’s current security advisory and support page rather than relying solely on a model list reproduced in an older article.