# FBI: criminals turn end-of-life routers and off-brand Android devices into proxies; replace or remove them

> The FBI warns that cyber actors use TheMoon malware variants to install proxies on end-of-life routers with remote administration turned on, and that the BADBOX 2.0 botnet spreads through IoT devices such as streaming boxes, projectors and picture frames that were compromised before purchase or through unofficial app stores.

- Canonical URL: https://update.dsesecurity.com/updates/fbi-end-of-life-routers-themoon-badbox-2-iot-residential-proxy-botnet/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-19T00:27:58+00:00
- Modified: 2026-10-19T01:55:07+00:00
- Last reviewed by DSE: 2026-10-19
- Resource type: Briefing
- DSE priority: Important
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

The FBI warns that cyber actors use TheMoon malware variants to install proxies on end-of-life routers with remote administration turned on, and that the BADBOX 2.0 botnet spreads through IoT devices such as streaming boxes, projectors and picture frames that were compromised before purchase or through unofficial app stores.

## Potentially affected

Businesses, branch offices and remote workers using older routers, and any network that hosts consumer streaming, display or other off-brand Android devices.

## DSE recommendation

DSE recommends replacing routers that no longer receive firmware updates and removing off-brand Android streaming or display devices from business networks.

## Article

The FBI warns that cyber actors use TheMoon malware variants to install proxies on end-of-life routers with remote administration turned on, and that the BADBOX 2.0 botnet spreads through IoT devices such as streaming boxes, projectors and picture frames that were compromised before purchase or through unofficial app stores.

## Source facts

In a [public service announcement on end-of-life routers](https://www.ic3.gov/PSA/2025/PSA250507), the FBI says routers dated 2010 or earlier likely no longer receive manufacturer updates and that some end-of-life routers with remote administration turned on were compromised by a new variant of TheMoon malware, which lets cyber actors install proxies and commit crimes anonymously. It says TheMoon does not require a password to infect routers, and recommends replacing end-of-life routers, applying firmware updates, disabling remote management and using unique passwords of 16 to 64 characters.

A separate [FBI announcement on BADBOX 2.0](https://www.ic3.gov/PSA/2025/PSA250605) says the botnet consists of millions of infected devices, including TV streaming devices, digital projectors, aftermarket vehicle infotainment systems and digital picture frames, most manufactured in China, that were compromised before purchase or through apps from unofficial marketplaces and can become part of residential proxy services. Indicators it lists include requests to disable Google Play Protect, generic streaming devices advertised as unlocked, unrecognizable brands, Android devices that are not Play Protect certified and unexplained internet traffic.

## Applicability

Use this for office, branch and home-office networks, including remote workers’ routers and consumer devices on guest networks. Business-grade equipment has its own end-of-life schedules, so check each manufacturer’s support status.

## DSE recommendation

DSE recommends replacing routers that no longer receive firmware updates and removing off-brand Android streaming or display devices from business networks. Turn off remote administration on edge devices, keep consumer IoT on an isolated guest network, buy media and signage players from recognized brands with Play Protect certification where Android is used, and investigate unexplained outbound traffic.

## Verification

Check each router and firewall model against the manufacturer’s support list, confirm remote administration is off from the internet side, and review DHCP leases for unknown streaming or display devices.

## Official references

[FBI Internet Crime Complaint Center — Cyber Criminal Proxy Services Exploiting End of Life Routers](https://www.ic3.gov/PSA/2025/PSA250507). [FBI Internet Crime Complaint Center — Home Internet Connected Devices Facilitate Criminal Activity (BADBOX 2.0)](https://www.ic3.gov/PSA/2025/PSA250605). Reviewed October 19, 2026.

## Primary reference

- Name: FBI Internet Crime Complaint Center — Cyber Criminal Proxy Services Exploiting End of Life Routers
- Authority: www.ic3.gov
- URL: https://www.ic3.gov/PSA/2025/PSA250507
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “FBI: criminals turn end-of-life routers and off-brand Android devices into proxies; replace or remove them,” DSE Security, https://update.dsesecurity.com/updates/fbi-end-of-life-routers-themoon-badbox-2-iot-residential-proxy-botnet/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.