The FBI warns that cyber actors use TheMoon malware variants to install proxies on end-of-life routers with remote administration turned on, and that the BADBOX 2.0 botnet spreads through IoT devices such as streaming boxes, projectors and picture frames that were compromised before purchase or through unofficial app stores.
\nIn a public service announcement on end-of-life routers, the FBI says routers dated 2010 or earlier likely no longer receive manufacturer updates and that some end-of-life routers with remote administration turned on were compromised by a new variant of TheMoon malware, which lets cyber actors install proxies and commit crimes anonymously. It says TheMoon does not require a password to infect routers, and recommends replacing end-of-life routers, applying firmware updates, disabling remote management and using unique passwords of 16 to 64 characters.
\nA separate FBI announcement on BADBOX 2.0 says the botnet consists of millions of infected devices, including TV streaming devices, digital projectors, aftermarket vehicle infotainment systems and digital picture frames, most manufactured in China, that were compromised before purchase or through apps from unofficial marketplaces and can become part of residential proxy services. Indicators it lists include requests to disable Google Play Protect, generic streaming devices advertised as unlocked, unrecognizable brands, Android devices that are not Play Protect certified and unexplained internet traffic.
\nUse this for office, branch and home-office networks, including remote workers’ routers and consumer devices on guest networks. Business-grade equipment has its own end-of-life schedules, so check each manufacturer’s support status.
\nDSE recommends replacing routers that no longer receive firmware updates and removing off-brand Android streaming or display devices from business networks. Turn off remote administration on edge devices, keep consumer IoT on an isolated guest network, buy media and signage players from recognized brands with Play Protect certification where Android is used, and investigate unexplained outbound traffic.
\nCheck each router and firewall model against the manufacturer’s support list, confirm remote administration is off from the internet side, and review DHCP leases for unknown streaming or display devices.
\nFBI Internet Crime Complaint Center — Cyber Criminal Proxy Services Exploiting End of Life Routers. FBI Internet Crime Complaint Center — Home Internet Connected Devices Facilitate Criminal Activity (BADBOX 2.0). Reviewed October 19, 2026.
", "content_text": "The FBI warns that cyber actors use TheMoon malware variants to install proxies on end-of-life routers with remote administration turned on, and that the BADBOX 2.0 botnet spreads through IoT devices such as streaming boxes, projectors and picture frames that were compromised before purchase or through unofficial app stores.\nSource facts\nIn a public service announcement on end-of-life routers, the FBI says routers dated 2010 or earlier likely no longer receive manufacturer updates and that some end-of-life routers with remote administration turned on were compromised by a new variant of TheMoon malware, which lets cyber actors install proxies and commit crimes anonymously. It says TheMoon does not require a password to infect routers, and recommends replacing end-of-life routers, applying firmware updates, disabling remote management and using unique passwords of 16 to 64 characters.\nA separate FBI announcement on BADBOX 2.0 says the botnet consists of millions of infected devices, including TV streaming devices, digital projectors, aftermarket vehicle infotainment systems and digital picture frames, most manufactured in China, that were compromised before purchase or through apps from unofficial marketplaces and can become part of residential proxy services. Indicators it lists include requests to disable Google Play Protect, generic streaming devices advertised as unlocked, unrecognizable brands, Android devices that are not Play Protect certified and unexplained internet traffic.\nApplicability\nUse this for office, branch and home-office networks, including remote workers’ routers and consumer devices on guest networks. Business-grade equipment has its own end-of-life schedules, so check each manufacturer’s support status.\nDSE recommendation\nDSE recommends replacing routers that no longer receive firmware updates and removing off-brand Android streaming or display devices from business networks. Turn off remote administration on edge devices, keep consumer IoT on an isolated guest network, buy media and signage players from recognized brands with Play Protect certification where Android is used, and investigate unexplained outbound traffic.\nVerification\nCheck each router and firewall model against the manufacturer’s support list, confirm remote administration is off from the internet side, and review DHCP leases for unknown streaming or display devices.\nOfficial references\nFBI Internet Crime Complaint Center — Cyber Criminal Proxy Services Exploiting End of Life Routers. FBI Internet Crime Complaint Center — Home Internet Connected Devices Facilitate Criminal Activity (BADBOX 2.0). Reviewed October 19, 2026.", "content_markdown": "The FBI warns that cyber actors use TheMoon malware variants to install proxies on end-of-life routers with remote administration turned on, and that the BADBOX 2.0 botnet spreads through IoT devices such as streaming boxes, projectors and picture frames that were compromised before purchase or through unofficial app stores.\n\n## Source facts\n\nIn a [public service announcement on end-of-life routers](https://www.ic3.gov/PSA/2025/PSA250507), the FBI says routers dated 2010 or earlier likely no longer receive manufacturer updates and that some end-of-life routers with remote administration turned on were compromised by a new variant of TheMoon malware, which lets cyber actors install proxies and commit crimes anonymously. It says TheMoon does not require a password to infect routers, and recommends replacing end-of-life routers, applying firmware updates, disabling remote management and using unique passwords of 16 to 64 characters.\n\nA separate [FBI announcement on BADBOX 2.0](https://www.ic3.gov/PSA/2025/PSA250605) says the botnet consists of millions of infected devices, including TV streaming devices, digital projectors, aftermarket vehicle infotainment systems and digital picture frames, most manufactured in China, that were compromised before purchase or through apps from unofficial marketplaces and can become part of residential proxy services. Indicators it lists include requests to disable Google Play Protect, generic streaming devices advertised as unlocked, unrecognizable brands, Android devices that are not Play Protect certified and unexplained internet traffic.\n\n## Applicability\n\nUse this for office, branch and home-office networks, including remote workers’ routers and consumer devices on guest networks. Business-grade equipment has its own end-of-life schedules, so check each manufacturer’s support status.\n\n## DSE recommendation\n\nDSE recommends replacing routers that no longer receive firmware updates and removing off-brand Android streaming or display devices from business networks. Turn off remote administration on edge devices, keep consumer IoT on an isolated guest network, buy media and signage players from recognized brands with Play Protect certification where Android is used, and investigate unexplained outbound traffic.\n\n## Verification\n\nCheck each router and firewall model against the manufacturer’s support list, confirm remote administration is off from the internet side, and review DHCP leases for unknown streaming or display devices.\n\n## Official references\n\n[FBI Internet Crime Complaint Center — Cyber Criminal Proxy Services Exploiting End of Life Routers](https://www.ic3.gov/PSA/2025/PSA250507). [FBI Internet Crime Complaint Center — Home Internet Connected Devices Facilitate Criminal Activity (BADBOX 2.0)](https://www.ic3.gov/PSA/2025/PSA250605). Reviewed October 19, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/fbi-end-of-life-routers-themoon-badbox-2-iot-residential-proxy-botnet/", "url": "https://update.dsesecurity.com/updates/fbi-end-of-life-routers-themoon-badbox-2-iot-residential-proxy-botnet/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-19" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/fbi-end-of-life-routers-themoon-badbox-2-iot-residential-proxy-botnet/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "FBI: criminals turn end-of-life routers and off-brand Android devices into proxies; replace or remove them", "item": "https://update.dsesecurity.com/updates/fbi-end-of-life-routers-themoon-badbox-2-iot-residential-proxy-botnet/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/fbi-end-of-life-routers-themoon-badbox-2-iot-residential-proxy-botnet/#article", "identifier": "https://update.dsesecurity.com/updates/fbi-end-of-life-routers-themoon-badbox-2-iot-residential-proxy-botnet/", "url": "https://update.dsesecurity.com/updates/fbi-end-of-life-routers-themoon-badbox-2-iot-residential-proxy-botnet/", "headline": "FBI: criminals turn end-of-life routers and off-brand Android devices into proxies; replace or remove them", "description": "The FBI warns that cyber actors use TheMoon malware variants to install proxies on end-of-life routers with remote administration turned on, and that…", "abstract": "The FBI warns that cyber actors use TheMoon malware variants to install proxies on end-of-life routers with remote administration turned on, and that the BADBOX 2.0 botnet spreads through IoT devices such as streaming boxes, projectors and picture frames that were compromised before purchase or through unofficial app stores.", "articleBody": "The FBI warns that cyber actors use TheMoon malware variants to install proxies on end-of-life routers with remote administration turned on, and that the BADBOX 2.0 botnet spreads through IoT devices such as streaming boxes, projectors and picture frames that were compromised before purchase or through unofficial app stores.\nSource facts\nIn a public service announcement on end-of-life routers, the FBI says routers dated 2010 or earlier likely no longer receive manufacturer updates and that some end-of-life routers with remote administration turned on were compromised by a new variant of TheMoon malware, which lets cyber actors install proxies and commit crimes anonymously. It says TheMoon does not require a password to infect routers, and recommends replacing end-of-life routers, applying firmware updates, disabling remote management and using unique passwords of 16 to 64 characters.\nA separate FBI announcement on BADBOX 2.0 says the botnet consists of millions of infected devices, including TV streaming devices, digital projectors, aftermarket vehicle infotainment systems and digital picture frames, most manufactured in China, that were compromised before purchase or through apps from unofficial marketplaces and can become part of residential proxy services. Indicators it lists include requests to disable Google Play Protect, generic streaming devices advertised as unlocked, unrecognizable brands, Android devices that are not Play Protect certified and unexplained internet traffic.\nApplicability\nUse this for office, branch and home-office networks, including remote workers’ routers and consumer devices on guest networks. Business-grade equipment has its own end-of-life schedules, so check each manufacturer’s support status.\nDSE recommendation\nDSE recommends replacing routers that no longer receive firmware updates and removing off-brand Android streaming or display devices from business networks. Turn off remote administration on edge devices, keep consumer IoT on an isolated guest network, buy media and signage players from recognized brands with Play Protect certification where Android is used, and investigate unexplained outbound traffic.\nVerification\nCheck each router and firewall model against the manufacturer’s support list, confirm remote administration is off from the internet side, and review DHCP leases for unknown streaming or display devices.\nOfficial references\nFBI Internet Crime Complaint Center — Cyber Criminal Proxy Services Exploiting End of Life Routers. FBI Internet Crime Complaint Center — Home Internet Connected Devices Facilitate Criminal Activity (BADBOX 2.0). Reviewed October 19, 2026.", "datePublished": "2026-10-19T00:27:58+00:00", "dateModified": "2026-10-19T01:55:07+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/fbi-end-of-life-routers-themoon-badbox-2-iot-residential-proxy-botnet/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/fbi-end-of-life-routers-themoon-badbox-2-iot-residential-proxy-botnet/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "FBI: criminals turn end-of-life routers and off-brand Android devices into proxies; replace or remove them" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Briefing", "Important priority" ], "genre": "Briefing", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 366, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "FBI Internet Crime Complaint Center — Cyber Criminal Proxy Services Exploiting End of Life Routers", "url": "https://www.ic3.gov/PSA/2025/PSA250507" } } ] } }