Home router targeted by proxy malware and cybercriminal activity linked to fraud, DDoS attacks, ransomware, and account abuse

How An Old Router Can Secretly Turn Into Criminal Infrastructure

By Geoffrey Wenger Published March 17, 2026 Updated June 25, 2026

Category: Cybersecurity

Tags: Botnet Data Privacy Malware Network Security Router

A hacked router does not always look hacked. Your Wi-Fi may still work, movies may stream, and speed tests may look fine while criminals quietly use your connection as cover. The SocksEscort case showed how forgotten home and small-office routers can become part of a criminal proxy network, turning everyday internet equipment into hidden infrastructure for fraud, account abuse, and larger cyberattacks without obvious warning signs for victims or businesses.

The Router Nobody Thinks About

Most people do not treat a router like a computer. They treat it like a power adapter. It gets plugged in, tucked behind a desk, and ignored until the internet stops working.

That habit is understandable. Routers are not exciting devices. They do not usually display files, photos, emails, banking screens, or business records. They just sit there blinking. But that quiet little box is also the front door to the entire network. Every phone, laptop, smart TV, printer, security camera, tablet, and desktop computer depends on it.

That is why old routers have become such attractive targets. They are always on. They are often exposed to the internet. Many are rarely updated. Some still use weak settings from years ago. Others are no longer supported by the manufacturer at all.

The March 2026 SocksEscort takedown made the problem harder to dismiss. According to the U.S. Department of Justice, SocksEscort was a residential proxy network that infected home and small-business routers with malware and sold access to those connections. The service had offered access to about 369,000 different IP addresses since 2020.

That is not just a bad Wi-Fi story. It is a warning about ordinary network equipment being converted into infrastructure criminals could rent and abuse. For a home user, that sounds strange. For a small business, it should sound serious.

A router is not just another device on the network. It is the edge of the network. When attackers compromise that edge, they may not need to touch your laptop first. They already have a useful position.

Why Working Routers Can Be Hacked

A compromised router can still appear completely normal. That is one of the reasons router infections are so dangerous. People expect malware to create visible problems: pop-ups, crashes, strange browser windows, missing files, or a computer that suddenly becomes painfully slow.

Routers do not behave that way.

In many router-based attacks, the goal is not to break your internet connection. The goal is to keep the router alive, quiet, and useful. Criminals want access to your public IP address, not necessarily your family photos or your browser history. If your connection works and nobody notices anything unusual, the router remains valuable.

That is especially true with residential proxy abuse. A residential proxy lets someone route traffic through a real home or small-business internet connection. To websites, banks, marketplaces, email platforms, and fraud detection systems, that traffic may look more trustworthy than traffic coming from a known data center or obvious criminal hosting provider.

That ordinary appearance is the point.

A hacked router may still:

Deliver normal Wi-Fi to your devices.
Pass basic speed tests without obvious trouble.
Stream video and load websites normally.
Show no pop-ups, alerts, or antivirus warnings.
Relay criminal traffic quietly in the background.
Use your public IP address as a disguise.

This is what makes the threat feel unfair. The owner may not know the router is being abused. There may be no dramatic symptom. The network works, so the danger stays invisible.

The FBI has warned about residential proxy networks because criminals can use ordinary home connections to hide their real identity and location. That means the router is not always the final target. Sometimes it is the mask.

SocksEscort Changed The Picture

SocksEscort was not just a technical nuisance. It was a reminder that home and small-office routers can be useful to organized cybercrime.

Europol described SocksEscort as a malicious proxy botnet that compromised routers and internet-connected devices, allowing criminals to hide their original IP addresses. In the March 2026 operation, authorities reported action involving seized domains, servers, and infrastructure connected to the service.

The numbers matter because they show scale. This was not a one-off router infection in somebody’s spare bedroom. It was a global criminal service built around compromised devices. Many victims likely had no idea their equipment had been turned into a tool for someone else.

Residential proxy networks are valuable because they make abusive activity look more ordinary. Criminal traffic coming from a real household or small business can blend in with legitimate traffic. That can help criminals attempt fraud, account takeover, spam, marketplace abuse, credential attacks, and other activity while making detection more difficult.

A compromised router can help criminals:

Hide the real source of suspicious traffic.
Make fraud attempts look residential.
Route account-abuse attempts through trusted-looking IP addresses.
Support password spraying or credential-stuffing activity.
Make investigation harder for security teams.
Keep criminal infrastructure distributed across many victims.

For small offices, the concern goes beyond embarrassment or inconvenience. A router sits between the business and the internet. If that device is compromised, it may become a quiet relay point for abuse. In worse cases, a neglected edge device can become part of a larger security problem, especially when the same network also supports business email, payment systems, customer records, or remote work access.

Old Firmware Is A Quiet Risk

Routers run firmware. Firmware is the built-in software that controls how the device works. It handles routing, Wi-Fi, firewall behavior, device administration, and other network functions.

When firmware is kept current, known vulnerabilities may be patched. When firmware is ignored for years, known flaws may remain open. Attackers often do not need a brand-new trick when old devices are still running old software.

This is where many households and small offices fall behind. People update phones. They update Windows. They update browsers. They may even update smart TVs. But router firmware? That often gets forgotten.

Some newer routers can install firmware updates automatically. Others require the owner to log into the admin panel, check the current version, download an update, and install it manually. ISP-provided gateways may be patched by the internet provider, but that depends on the provider, the model, and whether the device is still supported.

The FBI’s AVrecon alert on malware-infected routers exploited by SocksEscort explains that routers without regular security updates can be exposed to known but unpatched vulnerabilities. Attackers understand this. They look for neglected devices, exploit weaknesses, install malware, and use the devices as residential proxies.

Old firmware becomes especially risky when combined with poor settings. A router with outdated software, default credentials, unnecessary remote management, and forgotten port-forwarding rules is a much easier target than one that is patched, locked down, and actively supported.

The uncomfortable truth is simple. A router can still “work” long after it stops being safe.

Settings Worth Checking First

The best response to router risk is not panic. It is inspection.

Start with the router itself. Find the model number, manufacturer, firmware version, and support status. If you bought the router, check the manufacturer’s support page. If your internet provider supplied the gateway, contact the provider and ask whether that exact model is still receiving security updates.

Then log into the router admin panel. The address is often printed on the router label or listed in the provider’s app. Once inside, look carefully. You are not trying to become a network engineer. You are checking whether the router still looks trustworthy.

Review these items first:

Firmware version and last update date.
Automatic update settings.
Router admin username and password.
Remote administration or remote management settings.
DNS server settings.
Port-forwarding rules.
Unknown devices connected to the network.
Guest network status.
Wi-Fi encryption mode.
WPS settings.

Pay special attention to remote administration. This setting can allow the router’s admin panel to be reached from outside your home or office network. Most home users do not need that feature. Many small offices do not need it either. If it is enabled without a clear reason, disable it.

DNS settings also deserve attention. DNS is the system that helps translate website names into internet addresses. If a router’s DNS settings have been changed to servers you do not recognize, that can be a warning sign. Sometimes DNS changes are legitimate, especially if you use a known security DNS provider. But unexplained DNS changes should not be ignored.

The Cybersecurity and Infrastructure Security Agency recommends safer wireless-network practices such as changing default usernames and passwords, keeping network devices updated, and using stronger router settings. Those basics may sound simple, but simple is not the same as optional.

Port-forwarding rules should be reviewed the same way. Some rules may exist for cameras, games, servers, or remote access tools. Old rules that no longer serve a real purpose should be removed. Every unnecessary opening creates another chance for exposure.

When Replacement Beats Repair

Not every router problem can be fixed with a setting change.

If a router is still supported, a careful reset, firmware update, strong admin password, and settings review may be enough. But if the device is end-of-life, cannot receive updates, or has no clear security support path, replacement may be the safer choice.

This is especially true for small offices. A cheap router may feel like a harmless cost-saving decision until it becomes the weakest point in the entire environment. If that router handles business traffic, payment activity, customer communication, remote work, or administrative systems, the risk is not theoretical.

CISA has also published guidance on securing network infrastructure devices, including the importance of controlling remote administration access and protecting routers and switches with stronger safeguards. That principle applies at different levels, from home offices to business networks.

Replacement makes sense when:

The manufacturer no longer supports the model.
Firmware updates are unavailable or years out of date.
The router has known serious vulnerabilities.
Remote management cannot be safely disabled.
The admin interface behaves strangely.
DNS settings keep changing without explanation.
The ISP cannot confirm the gateway is still patched.
You cannot verify the router is clean after a suspected compromise.

A factory reset can remove some unwanted changes, but it does not magically make unsupported hardware safe. If the same old firmware remains, the same weakness may remain too. Replacing an outdated router is not overreacting. It is basic network maintenance.

Think of it like a front door lock. If the lock is broken and replacement parts no longer exist, polishing the handle does not solve the problem.

Small Offices Have More At Stake

For a home user, a compromised router is stressful. For a small office, it can become operationally damaging.

Small businesses often rely on one router or gateway for everything. Employee computers, payment systems, printers, phones, security cameras, cloud apps, accounting tools, and customer communication may all depend on the same network edge. If that edge is neglected, the entire business inherits the risk.

The problem is not that every old router will automatically lead to a breach. The problem is that unsupported network hardware can quietly increase exposure while giving the business owner no obvious warning. Internet access keeps working. Employees keep working. The invoice printer keeps printing. Nothing feels urgent until something breaks, gets abused, or gets investigated.

Small offices should treat router maintenance as part of normal business hygiene. It does not need to be complicated, but it should be deliberate.

At minimum, a small office should know:

Who manages the router.
Whether the router is owned or ISP-provided.
Whether firmware updates are automatic.
Whether remote admin access is disabled.
Whether guest Wi-Fi is separated from business devices.
Whether old port-forwarding rules still exist.
Whether the router is still supported.
When the router should be replaced.

That last point matters. Routers should not be left in service indefinitely just because they still power on. A device that protects the edge of a business network deserves a replacement cycle, even if it is not glamorous.

After The Router Is Handled

Router security and computer cleanup are related, but they are not the same job.

If a router is suspected of being compromised, the first priority is the router itself. That means checking firmware, support status, DNS settings, admin access, remote management, and connected-device behavior. In some cases, it means factory resetting the router or replacing it completely.

Cleaning a Windows PC does not disinfect router firmware. Antivirus software on a computer does not remove malware from a separate router. A router is its own device with its own operating environment. That distinction is important because it prevents false confidence.

After the router has been reviewed, reset, updated, or replaced, the local computers still deserve attention. A neglected or compromised network can leave users dealing with browser clutter, old temporary files, confusing system leftovers, stale network behavior, and general system noise. That does not mean every PC is infected. It means cleanup and review are practical next steps after restoring trust at the network edge.

This is where JENI® has a practical role. JENI® does not claim to repair a hacked router. It supports local Windows maintenance after the router issue has been handled. That separation keeps the job honest.

Router work belongs at the network edge. Windows cleanup belongs on the PC.

JENI® can help users clean browser cache, temporary files, logs, and system clutter after the network side is addressed. It can help reduce leftover junk, restore order, and make the computer environment easier to review. For home users and small offices, that kind of maintenance is useful because security is not only about dramatic threats. It is also about reducing confusion and keeping systems manageable.

Common Router Security Questions

How do I know if my router was hacked?

You may not know from normal browsing alone because many router compromises are designed to stay quiet. Check the router model, firmware date, support status, admin settings, DNS settings, remote-management exposure, and unknown connected devices.

Can antivirus fix a hacked router?

No. A router is a separate network device with its own firmware, so antivirus software on a Windows PC does not clean the router itself. If the router is compromised, the fix usually involves firmware updates, settings review, factory reset, ISP support, or hardware replacement.

Are ISP routers safer than store models?

Not automatically. Some ISP-provided gateways are actively managed and patched, while others may stay in service for years without clear support. The important question is whether your exact model is still supported and receiving security updates.

Should I reset or replace my router?

Reset and update the router if it is still supported, current firmware is available, and suspicious settings can be corrected. Replace it if the device is end-of-life, cannot be updated, has unexplained changes, or cannot be trusted after review.

Why would criminals want my router?

Your home or small-office IP address looks ordinary, which makes it useful for hiding abusive traffic. Criminals may use compromised routers as residential proxies to support fraud, account abuse, credential attacks, spam, and other activity while masking their real location.

A Safer Network Starts Quietly

Router security is easy to ignore because routers are quiet when they work. That silence can be misleading. A router can pass traffic, keep Wi-Fi online, and look normal while criminals use it as part of a proxy network.

The SocksEscort case showed how valuable neglected routers and internet-facing devices can become. For attackers, a home or small-office connection offers something useful: believable traffic from a real residential or business IP address. For the owner, the warning signs may be weak, confusing, or nonexistent.

The right response is practical. Check the router. Confirm support. Update firmware. Disable remote management unless it is truly needed. Change default passwords. Review DNS and port-forwarding rules. Ask your ISP whether the gateway is still patched. Replace unsupported hardware when it can no longer be trusted.

Once the router is handled, clean up the local computer environment too. JENI® helps with the Windows side by reducing clutter, clearing common buildup, and supporting routine maintenance after the network edge has been reviewed. A safer setup starts with the router, but it does not end there. The whole environment should be easier to trust, easier to maintain, and less useful to someone who should never have been there in the first place.