Your Router Might Already Be Part of Someone Else's Botnet — Here's What's Actually Going On

In October 2024, Microsoft published something that should have gotten more attention than it did.

They'd been tracking a network of compromised home and small-office routers — thousands of them, mostly TP-Link devices — that multiple Chinese state-sponsored hacking groups had been quietly using since 2021. Not to attack the router owners directly. To use their routers as a launchpad to attack other targets, while the actual owners had no idea anything was wrong.

That's the core of what's driving a much bigger story that's unfolded since.

The timeline, briefly

May 2023: Check Point Research found a Chinese hacking group using a firmware implant on TP-Link routers to target European foreign affairs offices.

October 2024: Microsoft's findings on the router botnet, described above.

Through 2025: A congressional investigation, then a Texas Attorney General lawsuit accusing TP-Link of marketing routers as "Made in Vietnam" while sourcing nearly all components from China — with the state's argument being that Chinese law can compel companies with China-based supply chains to hand data to Chinese intelligence services on request.

March 2026: The FCC moved to restrict foreign-made routers broadly, with Chinese manufacturers as the clear primary target, requiring foreign firms to demonstrate security before market access is presumed.

What the security researchers actually found, not just the political framing

Strip away the US-China policy fight for a second, because the underlying technical findings are what matter for your own home network regardless of which country's regulators do what.

Three named Chinese state-sponsored campaigns have specifically exploited router vulnerabilities: Volt Typhoon (targeting critical infrastructure — water and power systems), Salt Typhoon (which compromised major US telecom carriers including AT&T and Verizon), and Flax Typhoon. These aren't disputed by TP-Link or anyone else — they're documented by multiple independent security firms and Microsoft, not just government agencies with a policy agenda.

That's the part that isn't really contested. What is contested is what to do about it.

TP-Link's response, for fairness

TP-Link Systems — based in Irvine, California, and legally separate from the China-based TP-Link Technologies that sells only within mainland China — disputes that its products are meaningfully less secure than competitors. The company says the Chinese government has no access to or control over its design and production, and points out it's signed onto CISA's Secure by Design pledge, a US cybersecurity commitment.

Worth taking seriously: a former NSA hacker turned security consultant, Jake Williams, made a genuinely fair critique of the broader policy response — a standards-based security requirement would target the actual problem better than a blanket geographic ban, since, in his words, you can build an insecure router in Tulsa as easily as in Shenzhen if the underlying security standards aren't enforced.

Where I'd land on this, honestly

The vulnerability evidence — Check Point's findings, Microsoft's botnet tracking — comes from independent security researchers, not government press releases, and it's been consistent across multiple years and multiple firms. That part is solid.

Whether banning routers by country of origin is the right policy response, versus enforcing security standards regardless of where a router is made, is a genuinely more debatable question, and reasonable security experts land on different sides of it.

What this actually means for you, regardless of where you live

This isn't just a US story. Allied governments — the EU, Japan, South Korea, Australia — are reportedly watching how this plays out before deciding whether to follow with similar restrictions of their own. And the practical risk isn't limited to one brand or one country's regulatory response — any internet-connected router that isn't kept updated is a plausible target, from any manufacturer.

The actual checklist worth running through today

Log into your router's admin panel (usually by typing its IP address, often 192.168.1.1 or 192.168.0.1, into a browser) and check these:

• Firmware is up to date — most routers have an update check buried in settings, and most people never touch it after setup.
• The admin login isn't still the factory default username and password. This alone is one of the most common ways routers get compromised.
• Remote administration is turned off unless you specifically need it — this setting lets someone manage your router from outside your home network, which is a real exposure point if left on unnecessarily.
• WPA3 is enabled for your WiFi security, or WPA2 at minimum. If your router only offers WEP or an older standard, that's a sign the hardware itself is old enough to be a real risk.
• If your router is more than 5-6 years old and no longer receives firmware updates from the manufacturer, that's the point where replacing it becomes a legitimately reasonable security decision, not just an upsell.

None of this requires technical expertise beyond logging into a settings page you've probably never opened. It's a fifteen-minute check that closes most of the actual exposure points involved in this story, regardless of what happens with the broader policy fight over specific brands.

Related Reading

Stop Picking Perfume by Brand

Everything You Know About Booking Cheap Flights

 No, Climate Scientists Are Not Saying Humanity Is Doomed in 20 Years