The FBI and NSA revealed that Russia's GRU unit, known as Fancy Bear, has been systematically compromising home and small office routers since at least 2024. Using a court order, the agencies remotely reset thousands of affected devices in the US to disrupt what they described as an ongoing espionage campaign intercepting credentials and sensitive communications.

Affected models include a wide range of TP-Link devices such as the TL-WR841N, Archer C5, C7, and multiple WDR-series routers, most dating back to around 2007. The FBI warns these routers no longer receive firmware updates, leaving them permanently vulnerable to further attack.

For most people this isn't urgent since the listed models are quite old, but anyone still using them should replace them. The FBI recommends enabling automatic firmware updates, changing default admin passwords, disabling remote management, and using a VPN for remote work access.