TL;DR:
- The AryStinger botnet has compromised over 4,000 routers in the UK by exploiting default credentials and unpatched firmware — most victims have no idea
- A compromised router gives attackers a persistent foothold inside your network that bypasses most endpoint security software
- Fixing this takes about 30 minutes: update firmware, change default credentials, disable remote management, and enable logging
When people think about small business cybersecurity, they think about email phishing or password managers. Rarely the router. It sits in the corner, the little box with blinking lights that everyone assumes is fine because the internet is working. That assumption is now reliably wrong.
The AryStinger botnet, documented by UK security researchers in mid-2026, has enrolled over 4,000 routers across the country into a network that carries out distributed denial of service attacks, relays malicious traffic through small business internet connections, and in some configurations scans the internal network for other exploitable devices. The owners of those routers mostly do not know this is happening.
The entry method is unglamorous: default passwords that were never changed, and firmware updates that were never applied. The router ships from the factory with credentials printed on a sticker on the bottom. A significant proportion of business routers in the UK are still running those credentials months or years into deployment.
Why Routers Are Targeted
A compromised router is qualitatively different from a compromised endpoint. An attacker who gets into a laptop has access to one device and whatever files, accounts, and applications that person uses. An attacker who compromises your router has a position inside your network that is invisible to most security tools.
Endpoint security software — antivirus, EDR, whatever you have on your computers — does not monitor router traffic. Email security tools do not see what the router is doing. The router sits between your devices and the internet, and most businesses have no visibility into what it is actually doing on their behalf.
From that position, an attacker can:
- Monitor all unencrypted traffic leaving your network, including authentication tokens
- Redirect traffic intended for legitimate websites to fraudulent copies (DNS hijacking)
- Access other devices on your network — printers, NAS drives, cameras, payment terminals
- Use your internet connection for attacks on other organisations, which may result in your IP address being blocked or reported
The last point matters because many payment processing systems and business services rate-limit or block IPs associated with malicious activity. If your router’s IP gets onto a blocklist because an attacker is using it, your legitimate business traffic may start failing in ways that are hard to diagnose.
The 30-Minute Fix
This does not require an IT professional. These are the four things you need to do:
1. Log into your router’s admin panel
The admin address is usually printed on the router — typically 192.168.0.1 or 192.168.1.1. Type that into your browser’s address bar. If you cannot get in because the admin password has been changed from the default and you do not know what it was changed to, perform a factory reset (usually a pin-hole button on the back) and start from step one.
2. Change the admin password immediately
The default credentials are public knowledge. They are indexed by model in databases that attackers use. Once you are in the admin panel, find the password setting (usually under Administration or Management) and change it to a strong password — ideally a randomly generated one of at least 12 characters. Store it in your password manager, not on a sticky note.
3. Update the firmware
Find the firmware update option (usually under Administration, Advanced, or System). Most modern routers will check for updates automatically when you click the button. Apply any available updates. Some older routers require you to download the firmware from the manufacturer’s website and upload it manually. If your router is more than five years old and the manufacturer no longer provides firmware updates, it is time to replace it.
4. Disable remote management
Remote management allows the router admin panel to be accessed from outside your network. For almost all small businesses, this feature should be off. Look for settings labelled Remote Management, WAN Access, Remote Admin, or Web Access from WAN. Turn them off.
A fifth step, if your router supports it: enable logging and point the logs at a syslog server or at least check them occasionally. You are looking for unusual outbound connections, particularly to IP addresses you do not recognise or during hours when no one is using the office.
Choosing a Replacement If Yours Is Beyond Help
If your router is from a manufacturer that has stopped issuing firmware updates — which applies to a significant proportion of routers more than four or five years old — replacement is the safest option.
For small businesses, the models worth considering in 2026 include the TP-Link Deco range (for offices needing Wi-Fi coverage across multiple rooms), Asus routers running AiProtection (powered by Trend Micro, provides some network-level threat detection), and UniFi Dream Router from Ubiquiti (more complex to configure but provides enterprise-grade visibility and control at a reasonable price).
Whatever you buy, check that the manufacturer has a track record of issuing firmware updates for at least three to five years after launch, and that automatic update notifications are enabled from day one.
The Ongoing Habit
Router security is not a one-time fix. Set a recurring calendar reminder — quarterly is fine — to check for firmware updates and review which devices are connected to your network. An unknown device in the connected devices list is worth investigating. Many attacks begin with a device that was compromised through the router and is now sitting quietly on the internal network.
The AryStinger botnet campaign is not a sophisticated nation-state operation. It is automated exploitation of the lowest-hanging fruit available: routers running factory credentials and years-old firmware. Closing that gap requires about 30 minutes of your time.