The NSA and FBI say Russian military hackers hijacked home routers and urge a weekly reboot

Two of the country’s top security agencies have pressed households with a warning that sounds almost too simple: reboot the internet router. The guidance from the National Security Agency and the Federal Bureau of Investigation follows findings that hackers linked to Russian military intelligence compromised home and small-office routers to build networks of hijacked devices. A regular power-cycle, the agencies say, can disrupt certain kinds of intrusions that lurk on always-on equipment.

Why home routers became a target

The router is one of the most overlooked devices in any home. It runs continuously, rarely receives attention, and often keeps whatever software it shipped with for years. That combination makes it attractive to attackers, who can install malicious code and use the device as a foothold without the owner noticing any change in how the internet behaves.

According to the guidance, hackers tied to Russian military intelligence exploited exactly these weaknesses, compromising home and small-office routers and folding them into infrastructure they controlled. Because the devices sit at the edge of a home network, a compromised router can quietly route or observe traffic, making it a valuable prize even when nothing on it looks obviously wrong. The absence of an obvious symptom is precisely what lets such a compromise persist. A device that shows no outward sign of trouble gives its owner no prompt to intervene, and intruders count on exactly that silence.

What the NSA and FBI actually recommend

The core piece of advice is to reboot routers and connected devices regularly, on the order of once a week. Reporting on the joint warning notes that a periodic reboot can clear certain non-persistent malicious code from memory and interrupt an intruder’s hold on the device. The recommendation, described in coverage of the agencies’ router warning, is deliberately something an ordinary household can do without technical expertise.

A reboot is not presented as a complete fix. Some malware is built to survive a restart, and a device with an unpatched vulnerability can be reinfected. But a weekly power-cycle raises the effort required to maintain a persistent presence and buys time, which is why the agencies frame it as a baseline habit rather than a one-time cure. It is one layer among several rather than a standalone solution.

How a reboot disrupts an intrusion

Many router compromises rely on code that lives in the device’s working memory rather than being permanently written to it. Restarting the hardware wipes that memory, forcing an attacker to re-establish a foothold. For intrusions that depend on staying resident and unnoticed, repeatedly knocking them loose can be enough to break the chain, especially when combined with other basic hygiene.

That is why the timing matters. A router left running untouched for months gives an attacker a stable platform. A device restarted every week resets the board more often than an intruder may find convenient, particularly for the kinds of automated, large-scale operations that depend on quietly accumulating compromised machines and keeping them online without interruption. In that context an unpredictable weekly interruption is a small but genuine obstacle to an operation that prizes stability.

What makes home routers hard to defend

Part of the challenge is that a router offers almost no feedback about its own health. It has no screen, no notifications, and no obvious way to signal that its software is outdated or that an intruder is present. As long as web pages load and video streams play, most owners have no reason to look closer, and the device fades into the background of a home.

That invisibility is the flip side of the router’s reliability. A machine that quietly does its job for years invites a set-and-forget mindset, and manufacturers do not always make updates automatic or even easy to find. Many households also keep whatever router an internet provider supplied, a unit they may not feel is theirs to modify, which further discourages the updates and replacements the guidance calls for. The advice is aimed squarely at that gap, trying to convert a device people never think about into one they periodically tend.

The wider hygiene the warning points to

Rebooting is the headline, but the agencies’ broader message is that neglected network hardware needs the same care as any other computer. That includes installing firmware updates when a manufacturer releases them, replacing routers old enough that they no longer receive security patches, and changing default administrator passwords that attackers can easily guess or look up.

These steps address the root causes a reboot alone cannot. Updates close the vulnerabilities that let intruders in, and retiring unsupported hardware removes devices that will never be patched. Taken together with a regular restart, they form the layered approach the guidance describes, in which no single measure carries the whole burden of defense.

Why state-linked router hijacking matters beyond one home

The concern is not only that an individual household loses privacy. Compromised routers are often chained together into large networks that can be used to hide the origin of other attacks or to relay malicious traffic. When the intruders are tied to a national military intelligence service, those networks become tools of state activity, and every unsecured home device is a potential building block.

That is what turns a mundane piece of consumer electronics into a security question. The router most people forget about is exactly the device the guidance is trying to protect, and the recommended defenses are meant to be simple enough that they actually get done. By aiming the advice at a device in nearly every home, the agencies are treating routine maintenance as a matter of collective, not just individual, security.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

More from Morning Overview