The router had been working nonstop for years. No one had given it a second thought.
Cybercrime: Malice in Everyday Life — Part 2
You don’t have to be someone special to be targeted.
Everyday life has unseen points of entry. Drawing on publicly available information, we trace how these threats unfold quietly and how their consequences eventually surface in everyday life.
Something in a Familiar Place
Bob runs a small online shop from a room in their home.
They make leather goods and accessories by hand, photograph them, and list them in the online store. When an order comes in, they pack it and ship it. The camera used to photograph the products and the printer used for shipping labels are all in the same room.
An internet connection is essential, both for the business and for the family’s daily life.
The Wi-Fi router Bob bought several years ago, when the shop first opened, is still running in the corner of a shelf. Every now and then, Bob restarts it, but it has never caused any particular trouble. Videos play, the online store’s admin page loads, and the connection rarely drops.
There had been no reason to replace it.
One day, Bob received a message from their internet service provider.
The provider had detected unusual traffic coming from the internet connection associated with Bob’s account.
At first, Bob thought there must have been some mistake.
Had someone in the family visited a strange website? Was something wrong with the computer used for work?
But a check of the computers at home revealed nothing unusual.
Someone Is Using This Home’s Internet Connection
A specialist service provider was asked to investigate the network equipment.
The problem turned out to be that Wi-Fi router.
When they checked its model number, they found that manufacturer support had already ended. Even if a new vulnerability were discovered, no security patch would be provided for the device.
There was also a problem with its configuration: remote access to the router’s administration interface was still enabled.
The investigation indicated that a third party had likely compromised the router and was using it to relay traffic from elsewhere.
Bob had assumed that something might have been installed on their computer.
But this was a different kind of problem.
No one was necessarily controlling Bob’s computer. Nor was the attacker necessarily trying to steal customer information from the online shop.
What the attacker needed was the equipment in Bob’s home and the internet connection beyond it.
Someone Bob did not know was accessing the internet through the home’s connection.
The destination services would see the IP address assigned to Bob’s home connection, not the attacker’s own IP address.
In other words, from the outside, the traffic appeared to be coming from Bob’s home.
The arrangement worked like this:
Actual attacker
|
| Routes traffic through
v
[Router in Bob's home]
|
| Traffic uses Bob's home IP address
v
[External service]
|
+-- The recorded source appears to be Bob's home
This kind of arrangement is called a residential proxy.
It uses an ordinary household internet connection to relay traffic on behalf of a third party.
Attackers use residential proxies to conceal their real connection origin. They can also make tracking and detection more difficult when carrying out activities such as unauthorized access or fraudulent bank transfers.
Bob had never agreed to let anyone use the internet connection.
And there had certainly been no intention of helping anyone commit a crime.
An Address Put to Criminal Use
Bob had to replace the router.
The old device was no longer in a condition where it could be used safely. Bob informed the internet service provider of what had happened, and the other network equipment was also going to be checked.
Even after the investigation, some questions remained unanswered.
How long had the router been used without authorization?
How much traffic had been relayed during that time?
And who had done what through that connection?
It was not possible to establish everything.
Bob had done nothing.
Even so, external services might have records of suspicious access originating from the IP address assigned to Bob’s home.
To the people on the receiving end of that traffic, Bob’s home may have appeared to be a place from which an unknown person had carried out criminal activity.
This Isn’t Just Happening Somewhere Far Away
The misuse of devices in this way has been documented.
On May 7, 2025, the U.S. Federal Bureau of Investigation (FBI) warned that older routers whose manufacturer support had ended were being compromised by cybercriminals and used to relay criminal traffic.
In particular, routers that no longer received manufacturer support or security updates were being targeted through known vulnerabilities. Investigators had also identified tactics involving variants of malware known as TheMoon, which allowed routers to be used as proxies without their owners noticing.
And this is not only a problem overseas.
In July 2026, Japan’s National Institute of Information and Communications Technology (NICT), Ministry of Internal Affairs and Communications, and National Police Agency jointly published a fact sheet on residential proxies that abuse consumer IoT devices.
According to the document, NICT’s observations since January 2026 had identified as many as approximately 27,000 IP addresses per day acting as residential proxy exit nodes. The report estimated that at least tens of thousands of residential proxies were present in Japan.
The National Police Agency’s analysis also found that residential proxies had been used in at least 1,918 cases of internet banking fraud involving unauthorized transfers in 2024. This represented approximately 44% of all such cases.
Household internet connections and IoT devices that people rarely think about are already being misused as part of the infrastructure that supports cybercrime.
Even When You Never Meant to Open the Door
Bob had not installed a suspicious app or shared a password with a stranger.
They had simply kept using a device that had worked without problems for years.
The router powered on. Wi-Fi connected. The family and the business could use the internet as usual, without anything appearing to be wrong.
But a device functioning normally is not the same as a device functioning securely.
And what attackers seek is not always personal information or access to bank accounts. An internet connection, a device’s processing capacity, and even the IP address assigned to that connection can all be valuable resources to criminals.
I have no information worth stealing.
Why would anyone target a small business like mine? What would they gain?
Even so, an attacker may see a different kind of value in it.
In the corner of the shelf, the router’s lights are blinking again today.
Do they show ordinary, everyday traffic—or are they helping someone unknown carry out activities Bob knows nothing about?
There is no way to tell just by looking.
References
-
Federal Bureau of Investigation (FBI), “Cybercriminal Proxy Services Exploiting End-of-Life Routers,” May 7, 2025.
https://www.fbi.gov/investigate/cyber/alerts/2025/cybercriminal-proxy-services-exploiting-end-of-life-routers -
National Institute of Information and Communications Technology (NICT), “Fact Sheet Published on the Current State of Residential Proxies Exploiting Consumer IoT Devices,” July 21, 2026. (Japanese-language source.)
https://www.nict.go.jp/press/2026/07/21-1.html -
NICT, Japan’s Ministry of Internal Affairs and Communications, and Japan’s National Police Agency, “The Current State of Residential Proxies Exploiting Consumer IoT Devices,” July 21, 2026. (Japanese-language source.)
https://www.nicter.jp/report/20260721_residential_proxy_overview.pdf
The story in this article is a fictional reconstruction based on the router abuse case published by the FBI and the residential proxy research published by NICT, Japan’s Ministry of Internal Affairs and Communications, and Japan’s National Police Agency. It does not depict a person named Bob or a specific victim or incident in Japan.
Institutional note: NICT is Japan’s National Institute of Information and Communications Technology, the Ministry of Internal Affairs and Communications is a ministry of the Japanese government, and the National Police Agency is Japan’s national police organization. The FBI, by contrast, is a U.S. federal law enforcement agency.