The Botnet That Turned Old Routers Into Criminal Proxies

Millions of homes have an internet router that nobody thinks about anymore. But vulnerable and outdated routers can become something far more dangerous: part of a criminal proxy network. In 2024, researchers at Lumen observed more than 40,000 TheMoon bots across 88 countries. Thousands of ASUS routers were compromised in just a few days, while infected devices could be used to route other people's traffic through residential IP addresses. The investigation connected TheMoon to Faceless, a criminal residential proxy service. Even after infrastructure associated with TheMoon and Faceless was disrupted, the underlying business model didn't disappear. A newer botnet called KadNap later appeared, with more than 14,000 infected devices observed by March 2026. Lumen also identified a proxy service called Doppelgänger, which it believes may be a rebranding or successor to Faceless. The malware changed. The infrastructure changed. But the idea remained the same. Find forgotten devices. Take control of them. And turn ordinary internet connections into criminal infrastructure. This is the story of TheMoon.