If your team works remotely even part of the time, their home networks are part of your company’s security perimeter whether you planned for that or not. That router sitting in someone’s spare bedroom, the one their ISP installed three years ago and nobody has touched since, could be an open door into your business systems.

This isn’t a theoretical risk. In April 2026, the U.S. Department of Justice announced Operation Masquerade, which disrupted a campaign by a hacking unit of Russia’s GRU that compromised thousands of home and small-office routers. The attackers exploited known vulnerabilities in TP-Link routers to hijack DNS settings and redirect victims to fake Web pages that harvested passwords, authentication tokens, emails, and other sensitive information.

Here’s where DNS matters. DNS is the internet’s address book. When you type “yourbank.com” into a browser, your router looks up the real address and sends you there. When attackers get into your router, they swap out that address book for their own. Now your bank’s website sends you to a fake one that looks identical. You log in, they have your credentials, and you never knew anything was wrong.

If your team’s computers are managed by us, this is already part of our services. We configure DNS-level protection directly on the computers we manage, so even if a home router gets compromised, the device itself has a layer of defense that doesn’t depend on the router behaving. It’s not a reason to skip the router hygiene steps below, but it does mean your work machines aren’t left relying solely on a home (or public) network you don’t control.

Replace Unsupported Routers

Routers can last many years, but manufacturers eventually stop releasing firmware updates. Once that happens, known vulnerabilities go unpatched, and the router becomes ripe for attack. Check your manufacturer’s end-of-life lists (easily found with a search) to see if your model is still supported. If it’s not receiving security updates, replace it regardless of how well it still works.

When shopping for a replacement, look for routers from a well-known manufacturer with automatic firmware updates and a track record of long-term security support, such as Asus, Eero, Netgear, or Ubiquiti. Avoid bargain-basement devices from unknown manufacturers; any initial savings aren’t worth the security risk.

Keep Firmware Updated

The GRU attack exploited a known vulnerability that already had a patch available. That’s the part worth sitting with: the attack worked not because of a zero-day, but because people hadn’t applied an already existing fix.

Enable automatic firmware updates if the router supports it. If not, set a monthly calendar reminder to check manually. Keeping a router secure is an ongoing process, not a one-time setup task.

Change Default Passwords

Every router ships with default admin credentials, often printed right on the device itself. These defaults are well-known and easily found online. Change the admin password immediately after setup to a strong, unique one, and store it in a password manager (we prefer 1Password).

Change the default Wi-Fi network name and password, too. Use WPA3 for wireless encryption if available. Most modern routers support a compatibility mode that lets older devices connect while newer ones get the stronger security. Never use WEP, and never leave a network open.

Turn Off Remote Management

Many routers offer a remote login option that allows access to the administrative interface from elsewhere on the Internet (rather than within the router’s own network). Unless you specifically need this capability, deactivate it to reduce your exposure to external attacks. This setting is different from the app-based management provided by some modern routers, which uses a secure account and an outbound connection initiated by the router to enable remote access. App-based management is safe as long as your account password is strong, unique, and protected with two-factor authentication.

Check DNS Settings

The TP-Link attacks worked by changing DNS settings to quietly redirect users to malicious websites. Verify that your router’s DNS settings point to a trustworthy server.

One thing to know: leaving DNS set to your ISP’s default isn’t a neutral choice. ISPs routinely log DNS queries and use that data for ad targeting and marketing. You’re telling them every website you visit, and they’re using it.

Better options: Cloudflare (1.1.1.1) has a strong privacy track record and gets independently audited to back it up. Quad9 (9.9.9.9) is a non-profit based in Switzerland that actively blocks known malicious domains at the DNS level. Both are solid. We’d skip Google (8.8.8.8) for anything privacy-sensitive since Google’s business model is built on data collection.

If you see unfamiliar IP addresses in your router’s DNS settings that you didn’t put there, treat it as a red flag that something may already be compromised.

Optional Security Improvements

If you make sure you are using a router that’s still receiving security updates, are installing those updates, and have changed the default admin and Wi-Fi passwords, you’ve achieved an entirely acceptable level of security. With a little more time and effort, you can increase security further:

• Disable WPS (Wi-Fi Protected Setup): If your router supports this push-button pairing feature, turn it off to protect against known vulnerabilities that haven’t been patched for over a decade.
• Segment your network: If you have Internet of Things (IoT) devices—such as cameras, smart TVs, or smart home gear—consider creating a separate network for them. If one is compromised, network separation prevents it from accessing your computers or phones. However, some devices need to be set up or controlled via an app on the same network, so you may need to keep them on your main network.
• Consider your ISP gateway: Many ISPs provide gateways that combine the modem and router hardware. If you use an ISP-provided router, make sure you can control the necessary security settings. If you prefer to use your own router, make sure to disable its routing (switch to “bridge mode”) and Wi-Fi features to avoid creating another entry point to your network.
• Monitor your network: Periodically review which devices are connected to your network if your router’s admin interface or companion app makes that possible. Unfamiliar devices could indicate unauthorized access (though it’s more likely you didn’t realize some device connects to Wi-Fi because they seldom identify themselves well).
• Back up your network settings: To simplify reconfiguring your router or setting up a new one, create a backup of key settings. It could be as simple as a set of screenshots.

Home network security isn’t complicated, but it does require some thought at setup and occasional attention. If you’d like help with your network or a pointer to the routers we currently recommend, get in touch.

(Featured image by iStock.com/Igor Nikushin)