What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Yes—a home router, camera, streaming box, or other connected device can become part of a botnet if an attacker gains control of it. The attacker can then remotely direct the device to send attack traffic, relay internet activity, or support other intrusions, often without the owner noticing. A botnet is the network of compromised devices; the specific activity depends on the campaign, and not every botnet uses devices in the same way.
What a botnet is—and why routers and IoT devices are targets
A bot is an internet-connected device compromised with malware or otherwise placed under an attacker’s remote control. A botnet is the network of those devices. The FBI and IC3 define a botnet as “a network of Internet-connected devices compromised by malware that can be controlled remotely without the owners’ knowledge.” FBI/IC3, June 5, 2025
Routers and Internet of Things (IoT) devices—such as cameras, digital video recorders, streaming devices, projectors, and picture frames—are attractive targets because they are online and may be overlooked after setup. Some have weak or unchanged credentials, exposed services, unpatched software, or no remaining manufacturer support. In other cases, malicious software is already present or arrives through an app used during setup.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesHow attackers recruit a device into a botnet
Recruitment methods vary. A typical chain begins when an attacker finds an exposed device or one with a weakness, gains access, and installs or activates code that enables remote control. That code may contact command-and-control (C2) infrastructure, which can send instructions to infected devices. Some malware also scans for additional vulnerable devices, but not every botnet uses the same entry point or C2 design.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Common entry points
- Default or weak passwords: Attackers may try credentials that were never changed or are easy to guess. The 2017 FBI/IC3 Mirai advisory described openly accessible IoT devices, including routers, cameras, and DVRs, compromised with common default usernames and passwords. FBI/IC3, October 17, 2017
- Known vulnerabilities and exposed services: A flaw in a router or device software, or a service reachable from the internet, can provide a way in if it remains unpatched or unnecessarily exposed.
- End-of-life equipment: A product that no longer receives security updates can remain vulnerable to known flaws. The FBI says routers dated 2010 or earlier likely no longer receive manufacturer software updates and could be compromised through known vulnerabilities. This is a warning about those older routers, not a universal age cutoff for every model. FBI, May 7, 2025
- Malicious software or setup apps: A device may be compromised before purchase, or a user may install a malicious app from an unofficial marketplace while setting it up. FBI/IC3 described both routes in its BADBOX 2.0 notice. FBI/IC3, June 5, 2025
What happens after compromise
Once an attacker can control a device, it may receive commands, participate in an attack, relay traffic, or help reach other systems. In an FBI alert about TheMoon malware, the agency said the malware scans for open ports and sends commands to vulnerable scripts; a C2 server can then direct infected routers to scan for additional vulnerable routers. That describes the reported TheMoon activity, not a universal botnet sequence. FBI, May 7, 2025
What attackers can do with compromised devices
Launch distributed denial-of-service attacks
A distributed denial-of-service (DDoS) attack uses traffic from many devices to overwhelm a target, potentially slowing or preventing access to a website or network resource. FBI/IC3’s account of the 2016 Mirai campaign describes routers, cameras, and DVRs used for DDoS attacks. FBI/IC3, October 17, 2017
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Relay traffic through residential connections
A compromised home device can act as a proxy: traffic passes through the victim’s internet connection, so an outside service sees the residential IP address rather than the operator’s. The FBI says criminal proxy services used TheMoon-infected end-of-life routers to conceal actors’ identities and locations. FBI/IC3 also said BADBOX 2.0 maintained backdoors to proxy services through compromised home networks. FBI, May 7, 2025 FBI/IC3, June 5, 2025
Manipulate DNS or steal information in targeted campaigns
DNS translates domain names into the network addresses devices use to connect. In an operation described by the U.S. Department of Justice on April 7, 2026, Russian military intelligence actors exploited known vulnerabilities in TP-Link routers, stole credentials for thousands of routers worldwide since at least 2024, and changed some routers’ DNS settings. The DOJ said fraudulent DNS records for selected domains enabled actor-in-the-middle attacks that harvested unencrypted passwords, authentication tokens, emails, and other sensitive information from devices on the same network. This was a specific espionage campaign; it does not mean every compromised router manipulates DNS or steals information. U.S. Department of Justice, April 7, 2026
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Help compromise other networks
Compromised devices may also serve as a foothold for further intrusion. A 2024 joint advisory from the FBI, Cyber National Mission Force, NSA, and allied partners described PRC-linked actors compromising thousands of routers, firewalls, network-attached storage systems, and IoT devices, including with Mirai-family malware. The agencies said the devices were used as proxy infrastructure and for DDoS or to compromise targeted networks. These are agency findings about that operation, not a current count of all infected devices. Joint advisory, September 18, 2024
Examples show why the device and campaign matter
| Example | Devices or scale reported | Reported use or recruitment route | Source and date |
|---|---|---|---|
| Mirai | Routers, cameras, and DVRs | Devices with common default credentials were infected and used for DDoS attacks. | FBI/IC3, October 17, 2017 |
| TheMoon | Compromised routers, including end-of-life models | Reported use included proxy services; the malware could scan open ports and vulnerable scripts, with C2 instructions directing further scanning. | FBI, May 7, 2025 |
| BADBOX 2.0 | FBI/IC3 said the botnet consisted of millions of infected devices; examples included streaming devices, digital projectors, aftermarket vehicle infotainment systems, and digital picture frames. | Devices could be compromised before purchase or through malicious apps from unofficial marketplaces during setup; reported activity included proxy backdoors. | FBI/IC3, June 5, 2025 |
| GRU router operation | DOJ said actors stole credentials for thousands of TP-Link routers worldwide since at least 2024. | Some routers had DNS settings changed to support targeted actor-in-the-middle espionage. | U.S. Department of Justice, April 7, 2026 |
These campaign-specific figures should not be added together or treated as an estimate of global infections. The cited sources do not establish a current worldwide count of botnet-infected routers or IoT devices.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
How to reduce the risk on a home or small-office network
- Check router support status. Find the exact model and hardware revision on the device label or in its administration interface, then check the manufacturer’s official support information for security updates and end-of-support status. Replace a router that has reached end of life or no longer receives security patches; changing settings cannot fix unpatched vulnerabilities.
- Install firmware updates. Use the router’s official update mechanism or manufacturer instructions, and keep connected devices’ firmware and software current as well. Avoid firmware from unofficial sources.
- Turn off unneeded remote administration. In the router’s administration settings, disable remote management from the internet unless you specifically need it. Review firewall rules and remove unnecessary access to management services.
- Replace default credentials. Set a unique, strong router administrator password. The FBI’s 2025 alert recommends a random password between 16 and 64 characters. Change default usernames and passwords on IoT devices wherever the device allows it. FBI, May 7, 2025
- Review connected devices and network settings. Check the router’s device list for unfamiliar equipment and look for unexplained traffic or changed DNS settings. Consider disconnecting a suspicious device while you investigate. If your router supports a guest or isolated network, place IoT devices there; disable port forwarding when it is not required. FBI/IC3, October 17, 2017
- Be cautious during device setup. Avoid unofficial app marketplaces, especially when an app is required to set up a device marketed as unlocked or offering free streaming. FBI/IC3 lists those circumstances as potential BADBOX 2.0 warning signs, not proof that a specific device is infected. FBI/IC3, June 5, 2025
What to do if you suspect a router or IoT device is compromised
Slow internet or a warm router alone does not establish a botnet infection. Unexplained traffic, unfamiliar devices, or settings that changed without your action are reasons to investigate, but none is conclusive on its own.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
- Use a trusted connection to check the device. From the router’s administration interface or official support app, review connected devices, firmware status, remote-management settings, port forwarding, and DNS settings. Consult the manufacturer’s official guidance if you find changes you cannot explain.
- Update and secure the device. Install available official firmware or software updates, change administrator and device passwords, and disable unnecessary remote access. If the router is unsupported, replace it rather than relying on a reset as a substitute for security updates.
- Disconnect a suspicious IoT device if needed. This can limit its network access while you investigate. Avoid reinstalling apps from unofficial marketplaces or restoring settings from an untrusted source.
- Restart or reset only as appropriate. The FBI recommends updating, changing passwords, and rebooting as applicable. A reboot is not proof that malware has been removed; follow manufacturer-specific remediation instructions, especially for a device that remains unsupported or continues behaving unexpectedly. FBI, May 7, 2025
- Report suspected criminal activity. FBI/IC3 advises reporting suspected criminal activity to IC3 or contacting the FBI. FBI/IC3, June 5, 2025
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
