14,000 Routers Infected by Takedown-Resistant Malware in Ongoing Campaign

14,000 Routers Infected by Takedown-Resistant Malware in Ongoing Campaign

Security researchers have identified a widespread malware campaign that has infected approximately 14,000 routers across multiple countries with malware specifically designed to resist takedown efforts. The campaign represents a significant evolution in persistent network infrastructure attacks.

The Malware: Design for Resilience

The malware incorporates several features specifically designed to survive cleanup efforts:

• Peer-to-peer architecture: No central command-and-control server to take down
• Encrypted communications: All C2 traffic is encrypted, making traffic analysis difficult
• Multi-stage persistence: Multiple backup mechanisms ensure the malware survives factory resets
• Router diversity: Targets multiple brands and models, making patches harder to coordinate

Scale and Scope

• 14,000+ infected routers: Spread across multiple countries and ISPs
• Residential and business: Both home and enterprise routers are affected
• Geographic spread: Global distribution with concentrations in Europe and Asia

The Threat

Infected routers serve multiple malicious purposes:

1. Proxy networks: Routers are used as relay nodes for other attacks
2. Traffic interception: Man-in-the-middle attacks on connected devices
3. DDoS amplification: Botnet participation in distributed denial-of-service attacks
4. Credential harvesting: Intercepting credentials from connected devices

Why Router Malware Is Hard to Fight

Several factors make router malware campaigns particularly challenging:

• User awareness: Most users never check for router firmware updates
• ISP coordination: Cleaning up requires coordinated action across multiple ISPs
• Supply chain: Some routers may have been compromised before reaching consumers
• Resource constraints: Routers have limited CPU and memory for security software

Mitigation Steps

• Factory reset + firmware update: The most reliable cleanup, though some variants survive this
• ISP notification: Inform your ISP if you suspect infection
• Network monitoring: Watch for unusual outbound traffic patterns
• Replace old routers: Consider upgrading routers that no longer receive security updates

Source: Ars Technica | Full Report