The Federal Bureau of Investigation (FBI) and National Security Agency (NSA) recently issued a public warning regarding threat actors targeting small-office and home-office (SOHO) routers.
According to the FBI and NSA, cyber actors linked to Russian military intelligence have exploited vulnerable routers worldwide to support Domain Name System (DNS) hijacking, credential theft, and adversary-in-the-middle activity. The advisory specifically references compromised TP-Link routers using CVE-2023-50224, but the broader concern applies to any outdated or poorly secured home router.
Your home router sits between your devices and the internet. If compromised, an attacker may be able to redirect traffic, manipulate DNS settings, capture credentials, or present fraudulent login pages.
All home users should take the following steps:
For step-by-step home Wi-Fi security guidance, review CISA Project Upskill: Securing Your Home Wi-Fi. For more detailed technical guidance, review NSA Best Practices for Securing Your Home Network.
The FBI and NSA also recommend that small-office and home-office router users update firmware, change default usernames and passwords, disable internet-facing remote management interfaces, and upgrade end-of-support devices.
Be alert for:
If you are part of an organization, notify your internal IT or security team. If this is a personal home network, contact your internet service provider or router manufacturer for support.
If you believe you were targeted or compromised by the activity described in the FBI/NSA advisory, the FBI recommends reporting the activity to your local FBI field office or filing a complaint with the Internet Crime Complaint Center (IC3).
Restarting your router is a good immediate step, but it should not be the only step. The more important actions are updating firmware, changing default passwords, disabling remote management, reviewing DNS settings, paying attention to certificate warnings, and replacing unsupported devices.
Home routers are often forgotten after installation, but they are a critical part of protecting both personal and business access.
If you open a support ticket (support@dodsecurity.com) or call the helpdesk at (202) 792-3042, we can triage and respond per our incident response process.
We will contain and investigate right away, which may include endpoint or account isolation, telemetry review, identity and session checks, and other remediation actions aligned to our incident response playbooks.
Stay safe, stay secure.
-ISI Cybersecurity Team