The 2026 NSA Router Reboot Warning, Explained

What the NSA and FBI actually said

On April 7, 2026, the U.S. Department of Justice and FBI announced a court-authorized operation that disrupted a network of compromised home and small-office routers. Those routers had been quietly conscripted by a unit of Russia's GRU military intelligence service. In the days that followed, the NSA and FBI urged the public to take a handful of simple steps to secure their own routers — with regular reboots at the top of the list.

The headline advice is deliberately simple because it works for everyone: reboot your router regularly. As the NSA puts it in its long-standing home-network guidance, weekly restarts help "remove implants" — the hidden malicious code attackers try to leave behind.

Who was behind it

Security researchers track the group as APT28 — also known as Fancy Bear and Forest Blizzard — a unit tied to the GRU. Rather than attacking targets head-on, the group builds a hidden layer of hijacked home and small-office routers and routes its activity through them. That makes malicious traffic look like it's coming from an ordinary residential address, and gives attackers a foothold inside real home networks.

One documented campaign exploited a vulnerability in certain TP-Link routers, tracked as CVE-2023-50224. Devices that were outdated, running default settings, or no longer receiving security updates were the easiest to compromise.

Why a reboot matters so much

It sounds almost too simple, but rebooting is effective for a specific technical reason: a lot of router malware lives in memory, not on permanent storage. When you power-cycle the device, that memory is wiped and the malicious code has to fall away. A restart also drops the temporary connections attackers depend on, forcing them to start over — and buys you time while you apply firmware updates.

Rebooting is not a silver bullet. If your router has an unpatched vulnerability, it can be re-infected. That's why the NSA pairs "reboot regularly" with "update firmware" and "replace unsupported devices." Done together, these steps make your network a far harder target.

The full checklist the NSA recommends

• Reboot regularly — weekly at a minimum, to clear memory-resident malware.
• Update firmware — install security updates as soon as they're released.
• Change default usernames and passwords — never leave the factory login in place.
• Disable remote management from the internet unless you truly need it.
• Replace end-of-support routers that no longer receive security updates.

We break each of these down, step by step, in our router protection checklist.

Sources & further reading

This summary is drawn from public reporting on the 2026 advisory. Read the original coverage: