Security researchers warn of widespread router vulnerability exploited by Chinese-linked hackers

A major router security problem emerges

Cybersecurity researchers have discovered that hackers operating from China are actively targeting internet-connected routers to gain secret administrative control. These attackers, identified by security firms as UAT-7810, are systematically hunting for routers—particularly those manufactured by Ruckus—that haven't received the latest security updates. Once they break in, they install invisible backdoors that let them operate the devices remotely without the owner's knowledge.

The attackers are using these compromised routers as stepping stones to build what they call an "Operational Relay Box" network. Think of it like turning thousands of family homes into secret mail-sorting centers. The homeowners don't realize their property is being used, but criminals are routing their packages (in this case, malicious data and commands) through these locations.

Why this strategy works so well for attackers

Routers are incredibly valuable targets for cybercriminals because they sit at the gateway between your home or business and the internet. They see all the traffic flowing in and out. A hacker who controls your router can:

• Intercept passwords and financial information you send online
• Redirect you to fake websites that look legitimate
• Use your internet connection to launch attacks on other targets
• Deploy malware to devices on your network
• Monitor which websites you visit and which services you use

Additionally, most people never update their routers. A router sitting in a closet running two-year-old firmware is practically an open invitation to attackers. The security gaps haven't been patched, so anyone who knows about them can walk right through.

What this means

This discovery signals that nation-state level hackers are building massive infrastructure networks by exploiting everyday technology. Instead of targeting one company or one person, they're compromising thousands of routers to create a distributed system for launching larger cyberattacks, spreading malware, or conducting surveillance operations.

This type of botnet activity has been a concern for years, but the scale and sophistication here represents an escalation. The fact that these attackers are continuously updating their methods shows this is an active, well-funded operation rather than opportunistic cybercrime.

Why you should care

If your router gets compromised, you're at serious risk. Your personal information, banking details, and online accounts all pass through that device. An attacker with access could steal your identity, drain bank accounts, or use your connection to commit crimes that appear to originate from your location.

Beyond personal impact, this contributes to a larger cybersecurity problem. Every compromised router strengthens these criminal networks, making it easier for them to launch bigger attacks against businesses, government systems, and infrastructure.

What you can do

• Check for updates immediately: Log into your router's admin panel and look for firmware updates. Apply any available patches right away.
• Change default passwords: Most routers come with standard usernames and passwords. Change these to something complex and unique.
• Enable automatic updates: If your router supports it, enable automatic security updates so you don't have to remember.
• Know your router model: Identify what brand and model you own so you can track if it's affected by known vulnerabilities.
• Consider replacement: If your router is several years old, replacing it with a newer model that receives regular updates is worth considering.

Protecting your router is just as important as protecting your computer—probably more so, since it protects everything connected to your network.