FBI: End-of-life routers hacked for cybercrime proxy networks

The FBI warns that threat actors are exploiting known vulnerabilities in end-of-life Linksys and Cisco routers to install variants of the TheMoon malware, converting compromised devices into proxies that are sold on 5Socks and Anyproxy. These proxy botnets are used by cybercriminals and Chinese state-sponsored actors to obfuscate activity for espionage, cryptocurrency theft, and other illegal operations; the advisory lists affected models, signs of compromise, mitigation steps (replace or patch routers, change credentials, disable remote admin), and shared indicators of compromise.