Mysterious Cyber Attack Took Down 600,000+ Routers in the U.S.

Lumen Technologies' Black Lotus Labs details a destructive October 2023 campaign named "Pumpkin Eclipse" that rendered over 600,000 SOHO routers permanently inoperable across a single ISP ASN by delivering a destructive payload via the Chalubo remote access trojan. The attack targeted three router models (ActionTec T3200, ActionTec T3260, and Sagemcom), caused major service disruption and hardware replacement, and likely relied on dropped shell scripts and a Lua-based destructive module; the initial access method and actor attribution remain unresolved.