Security alert · Updated 2026-05-17
FBI Russian Router Malware Reset 2026: SOHO Router Cleanup, DNS Check and Account Protection Guide
A router malware reset alert means the network edge may have been used by attackers. Clean or replace the router before relying on VPN, antivirus or account changes alone.
Fast answer
Log in locally, verify DNS, disable remote management, update firmware, change the admin password, replace unsupported routers, rotate ISP/email/banking/work passwords and scan devices that used the affected network.
Source note: Web search provider was unavailable in this runtime, so this page avoids unsourced incident-specific claims and frames the alert as an action checklist for users who saw or confirmed the exposure. Verify official vendor/FBI notices before making incident assertions.
First-hour checklist
- Identify the exact router model, hardware version and firmware status.
- Log in through the local gateway only; avoid search ads or emailed router-login links.
- Verify DNS resolvers and remove unknown port-forwarding or remote-management rules.
- Update firmware, factory reset if compromise is suspected, and replace end-of-life routers that no longer receive patches.
- Change router admin, ISP portal, email, bank, work VPN and cloud account passwords using a password manager.
- Run endpoint malware scans and watch for certificate warnings, unexpected MFA prompts or suspicious account-login alerts.
Decision table
| When to act | Act immediately if a token, router, DNS setting, admin account or developer credential was exposed, changed unexpectedly or appears in an official notice. |
|---|---|
| Do not do this | Do not paste secrets into search engines or AI tools, do not keep unsupported routers online, and do not assume a VPN or antivirus alone fixes credential exposure. |
| FBI router botnet cleanup | FBI router botnet cleanup |
| Best malware removal tools | Best malware removal tools |
| Antivirus for ransomware | Antivirus for ransomware |
| Best VPN services | Best VPN services |
What to verify next
Confirm the official advisory, affected product or account scope, dates, indicators of compromise and remediation steps. Keep screenshots of suspicious settings, audit-log entries and alert timestamps before wiping devices or revoking access.
For identity risk, rotate passwords from a clean device, enable MFA or passkeys, check recovery email and phone settings, and monitor financial, cloud and developer accounts for unusual logins or billing changes.
Frequently asked questions
Does a VPN remove router malware?
No. A VPN can protect traffic after the router is trustworthy, but it does not clean malicious firmware or unsafe DNS settings.
Should I factory reset or replace the router?
Factory reset and update if the model is still supported. Replace it if the vendor no longer ships security updates.
Which accounts should I change first?
Prioritize router admin, ISP, email, banking, work VPN, cloud admin and any account used from the affected network.