SOHO routers (ASUS, TP-Link, Netgear, Cisco RV, MikroTik) are among the most heavily targeted devices in the world. Not for the data behind them, but for what they are: residential IP addresses that blend with legitimate traffic. China's Volt Typhoon built the KV Botnet from compromised SOHO routers to proxy their operations through US residential IPs, making their traffic indistinguishable from a home user browsing the web. Russia's APT28 used compromised Ubiquiti EdgeRouters for credential relay and botnet C2. The FBI disrupted the KV Botnet in January 2024. Volt Typhoon rebuilt it within 37 days.

The hunting challenge: you cannot install an agent on consumer router firmware. There is no Sysmon, no EDR, no process telemetry. The device runs a stripped-down Linux kernel that the vendor rarely updates and the owner never patches. Your entire detection surface is network flow data, DNS monitoring, and behavioral anomalies from the devices sitting behind the router.

Web management interface command injection. The router's admin web panel passes unsanitized input directly to the underlying Linux shell. CVE-2025-6542 and CVE-2026-0630 (TP-Link), CVE-2023-20073 (Cisco RV), and dozens of similar vulns in every consumer router vendor. The admin panel is often exposed on the WAN by default or reachable via CSRF from a compromised LAN device.

UPnP exploitation. Universal Plug and Play runs on most consumer routers by default, allowing any LAN device to open external-facing ports without authentication. Attackers abuse UPnP to expose internal services, redirect traffic, or force the router to proxy connections.

Firmware modification. Replacing the legitimate firmware image with a trojanized version containing static SSH keys, listening beacons, or embedded proxy tools. Survives reboots. The only remediation is reflashing from known-good media. Some firmware implants persist even through factory reset if they modify the bootloader.

Default and weak credentials. Many SOHO routers ship with default admin passwords that owners never change, or with known recovery credentials. Botnet operators scan entire ISP ranges for routers with default credentials on management ports.

1. 1. Hunt for the proxy loop (long-lived, low-bandwidth connections) Threat actors install reverse proxy tools (commonly FRP, Fast Reverse Proxy) on compromised routers. The tell: a home IP maintaining a permanent, long-lived, low-bandwidth TCP connection to an external server over an unusual port (random high ports, or port 443/80 traffic that doesn't match normal web browsing handshake sizes and patterns). These connections persist for days or weeks with minimal data transfer, punctuated by bursts when the proxy is actively relaying. NetFlow/IPFIX: long-duration sessions (>24h) to external IPs on non-standard ports · Zeek conn.log duration analysis
2. 2. Hunt for DNS hijacking Attackers swap the router's WAN DNS settings to an attacker-controlled upstream resolver. All DNS queries from every device behind the router now flow through the attacker's server, enabling phishing, credential interception, and traffic manipulation. The tell: outbound DNS queries from the router to non-standard public IP addresses rather than ISP defaults or hardened resolvers (1.1.1.1, 8.8.8.8, 9.9.9.9). Zeek dns.log: queries to unexpected upstream resolvers · Router config audit: DNS server settings
3. 3. Check for inbound management scans Spikes in external traffic hitting ports 80, 443, 8080, 8443, or 22 directly on the WAN IP interface. Botnet operators and nation-state scanners continuously probe residential IP ranges for exposed management interfaces. If your router's admin panel is reachable from the internet, it will be found. Firewall logs: inbound connections to management ports on WAN interface
4. 4. Hunt for CSRF/command injection from LAN devices A compromised device behind the router (IoT camera, phished laptop) attacks the router itself via the LAN. The tell: an internal host making rapid automated HTTP POST requests to the local gateway IP (192.168.1.1/cgi-bin/, /boafrm/, or vendor-specific admin endpoints). This indicates a local device attempting CSRF or command injection to compromise the router from inside. Zeek http.log: POST requests to gateway IP from non-browser user agents · IDS: internal-to-gateway exploit signatures
5. 5. Check for unexpected UPnP port mappings Audit active UPnP port mappings on the router. Legitimate UPnP use: gaming, media streaming on known ports. Suspicious: mappings for SSH (22), RDP (3389), SMB (445), or random high ports that no resident application would request. Disable UPnP if not needed. If needed, audit the active mappings regularly. Router admin: UPnP port mapping table · upnpc -l from LAN host
6. 6. Verify firmware integrity Compare the running firmware hash against the vendor's published hash for that version. If they don't match, the firmware has been modified. Check: router admin panel for firmware version, compare against vendor download page, and if possible, dump the firmware and hash it. Trojanized firmware survives reboots and may survive factory reset. Router admin: firmware version · Vendor website: published firmware hash · JTAG/serial dump if available
7. 7. Monitor for asymmetric internal traffic routing A compromised router may route traffic between internal devices unexpectedly. The tell: a LAN device broadcasting traffic to the gateway, but the gateway forwarding it to internal neighbors via attacker-configured UPnP rules or static routes. Internal-to-internal traffic routing through the gateway that doesn't match normal LAN behavior indicates router-level manipulation. NetFlow: internal-to-internal flows via gateway · ARP table audit
8. 8. Audit the router configuration directly If you can access the router admin panel: check DNS settings (should be ISP default or known resolver), check for unknown admin accounts, check for static routes that shouldn't exist, check for SSH keys you didn't add, check the list of connected devices against known devices, and verify that remote management (WAN-side admin access) is disabled. Router admin panel: every settings page · Config backup and diff against known-good

Volt Typhoon built the KV Botnet from compromised SOHO routers (Cisco RV, Netgear, ASUS, DrayTek) to proxy operations through US residential IPs. FBI disrupted it January 2024. Rebuilt within 37 days.
APT28 / Fancy Bear compromised Ubiquiti EdgeRouters for credential relay, botnet C2, and network reconnaissance infrastructure.
Sandworm used Cyclops Blink malware to build a botnet from WatchGuard and ASUS routers for C2 infrastructure and operational relay.
Commodity botnets (Mirai variants, Moobot) continuously scan for default credentials and known CVEs on consumer routers at massive scale.

Volt Typhoon (KV Botnet, SOHO router proxy infrastructure)
Edge Device Compromised (enterprise edge devices share the same exploitation patterns)
Living-off-the-Land Activity (the proxy traffic blends with legitimate residential browsing)
APT28 (Ubiquiti EdgeRouter compromise)