China’s primary cybersecurity coordination body, the National Computer Network Emergency Response Technical Team (CNCERT), has issued a high-level alert regarding a systemic wave of DNS tampering targeting home routers. The agency reports that millions of unsuspecting users are being redirected to illegal gambling and adult websites when attempting to access legitimate internet services. This large-scale manipulation of the Domain Name System (DNS)—the internet's directory—represents a sophisticated effort to exploit the weakest link in the domestic digital infrastructure: the household router.
Investigations by CNCERT reveal that attackers are leveraging weak administrative credentials and unpatched firmware vulnerabilities to gain control of these gateway devices. Once a router’s DNS settings are altered, every device connected to the Wi-Fi network, including smartphones and laptops, inherits the malicious configuration. This allows attackers to bypass traditional endpoint security by misdirecting traffic at the source, leading to high-frequency advertisement injection, phishing attempts, and the potential theft of sensitive account information.
The scale of the operation is staggering. CNCERT has identified dozens of rogue DNS servers and malicious web servers facilitating these redirections. At its peak, the campaign has recorded hundreds of millions of malicious resolutions per day, affecting upwards of 700,000 unique domestic IP addresses daily. This is not a localized nuisance but a mechanized, industrial-scale assault on the integrity of China's residential internet ecosystem.
Technically, the vulnerability stems from what cybersecurity experts call 'low-hanging fruit.' Many consumers continue to use default or easily guessable passwords for their router management interfaces, such as '123456' or birthdates. Furthermore, many budget router manufacturers have failed to implement robust security prompts or automated firmware updates, leaving the door open for automated scripts to infect internal networks and rewrite the 'signposts' of the web.
In response, CNCERT is urging citizens to conduct immediate 'security hygiene' on their home networks. This includes verifying DNS server addresses against known-good provider IPs, disabling high-risk features like remote management and Universal Plug and Play (UPnP), and upgrading to the latest manufacturer firmware. The agency has also released a list of over 50 specific Indicators of Compromise (IOCs), primarily malicious IP addresses, to help network administrators and tech-savvy users identify and block the threat at the source.