On April 7, 2026, the U.S. Department of Justice and the FBI announced “Operation Masquerade” — a court-authorized takedown of a network of small office and home office routers that Russian military intelligence had hijacked to spy on Americans in at least 23 states (U.S. Department of Justice). The compromised devices were almost all consumer-grade TP-Link routers — the same $79 box sitting under desks in law firms, title companies, and family-owned businesses all over Texas. The NSA co-signed the warning the same day (NSA). If you run a small business in DFW or Central Texas and your edge network is a consumer router, this is your warning.
What Actually Happened
The hackers were Russian GRU Military Unit 26165 — also known as the 85th Main Special Service Center, APT28, Fancy Bear, and Forest Blizzard. Since at least 2024, they exploited a known TP-Link flaw (CVE-2023-50224) to steal credentials from thousands of TP-Link routers worldwide, then quietly rewired the routers to send your internet traffic through Russian-controlled servers (DOJ). That technique is called DNS hijacking — and it lets an attacker silently intercept your email logins, financial passwords, and authentication tokens without you ever seeing a warning.
The FBI got a federal court order to remotely clean compromised routers in the United States. But the FBI was explicit: rebooting your router will not fix this (Fox Business). The cleanup buys time. It does not fix the underlying problem.
TP-Link’s Own Advisory Is Worse Than the News
On May 1, 2026, TP-Link published its own security advisory (TP-Link Security Advisory) listing more than 30 affected router and access point models. The advisory says — in TP-Link’s own words — three things every business owner needs to read twice:
- Most affected models are End-of-Life. They get no more updates. Period.
- Most are unpatched. Even the famous Archer C7 and TL-WR841N only have partial patches available.
- None of these models support cloud-based or automatic firmware updates. If a fix exists, you have to install it manually by downloading a file and uploading it through the router’s web interface.
In plain English: even if you do everything right, the manufacturer has admitted these devices were never designed to be kept secure for the long haul.
Why This Hits Texas SMBs Harder Than Anyone Else
Texas has one of the highest concentrations of small to medium sized businesses in the country with the DFW Metroplex being the national leader in SMB growth. We see consistently see 10-person law firms running everything through a router from a big-box store. Title companies on the box Spectrum installed in 2019. Landscaping companies running their billing system behind a router that hasn’t seen a firmware update since 2021.
It’s not negligence — nobody ever told them the difference between a router and a business firewall. A consumer router bought off a store shelf was never built for the job. Spectrum is now sending warning emails directly to TP-Link customers (r/HomeNetworking). The U.S. Commerce Department has already moved to ban new sales of certain foreign-made consumer routers (Fox Business). The federal government is telling you, on the record, that consumer-grade routers are no longer safe equipment for a business.
What You Should Do This Week
The FBI’s official remediation guidance, in their own four steps (DOJ):
- Replace any End-of-Life or End-of-Support router. Not patch it — replace it.
- Upgrade to the latest firmware on any router that still gets updates.
- Verify the DNS resolvers listed in your router settings — if they’re not your ISP’s or a known public resolver, you’ve been hijacked.
- Review and implement firewall rules to block exposure of remote management services.
That last one is the tell. The federal government is telling small businesses to put a real firewall in front of their network. A consumer router cannot do step 4. It was never built to.
For more practical security guidance, the NSA’s “Best Practices for Securing Your Home Network” and CNET’s plain-English summary of the FBI’s five steps (CNET) are both worth bookmarking.
Why a Business-Grade Firewall Is a Different Animal
A firewall is not just a fancier router. The job is fundamentally different:
- Most consumer routers run allow-by-default — outbound traffic gets a free pass. Most business firewalls run deny-by-default — every connection has to earn its way through. That single design choice is the difference between malware silently calling home and malware getting blocked at the wall.
- A business firewall does deep packet inspection — it reads the contents of network traffic, not just the address on the envelope.
- It runs intrusion prevention — it recognizes attack patterns and stops them in real time.
- It supports site-to-site and remote-user VPN so your branch office, your home office, and your road warrior connect through one secure tunnel.
- It’s rated for dozens of concurrent devices — servers, phones, printers, A/V — without choking.
This is what the industry calls a UTM firewall (Unified Threat Management). The category exists because consumer routers cannot do these things, no matter what the box on the shelf claims.
Our Preferred Firewall — and Why We Chose It
For our DFW and Central Texas managed-services clients, we deploy a firewall that meets a checklist we built specifically for the small-business market:
- 100% designed and supported in the United States. No foreign manufacturing. No support center overseas. No mystery firmware on the inside.
- Nightly automatic firmware and threat-intelligence updates. Every device checks-in every night and pulls the latest protection without you lifting a finger. You don’t manage it — we do.
- Built for business, not stretched up from a home product. Real throughput, real concurrent connections, real VPN capacity for staff who travel or work from home.
- One license, every feature included. No surprise add-on costs to turn on the security you already thought you were paying for.
- Threat-sharing across our customer base. When one of our protected networks sees a new attack, every other protected network receives definition updates.
That is what “business-grade” actually means.
Get a Free Firewall & Router Audit
We’ll do a no-cost, no-pressure review of your edge device, your router, and your firewall configuration. You’ll walk away with a report showing exactly where you stand — and what (if anything) you should do next — even if you never become a client.
Book your free audit by emailing Helpdesk@RightfITNetworks.com or Call 817-886-2687
— Jeffery Sneed, Owner, RightfIT Network Solutions
Texas-operated managed IT services for DFW and Central Texas.
