FCC Restricts New Foreign-Made Consumer Routers Over Cybersecurity Risks
Summary
The FCC added foreign-made consumer routers to its Covered List, barring new models from U.S. marketing or sale unless they receive Conditional Approval. Previously approved models and customers’ existing routers are unaffected.
Key points
- The FCC says new foreign-produced consumer router models are no longer eligible for marketing or sale in the U.S. unless granted Conditional Approval by the Department of War or DHS.
- The FCC cited supply-chain and cybersecurity risks to critical infrastructure and national security.
- The article says the government cited router botnets and threat actors including CovertNetwork-1658 (Quad7), Storm-0940, Volt Typhoon, Flax Typhoon, and Salt Typhoon.
- Customers can continue using routers they already purchased, and retailers can continue selling models previously approved through the FCC equipment authorization process.
- Router manufacturers can apply for Conditional Approval; the article says Starlink Wi-Fi routers are exempt because they are made in Texas.
Article Details
- Event Type
- FCC regulatory action adding foreign-manufactured consumer-grade routers to the Covered List, barring new models from import, marketing, or sale in the U.S. unless granted Conditional Approval.
- Impact
- The action restricts new foreign-made consumer routers, but does not affect continued use of routers already purchased or sales of models previously authorized by the FCC. Starlink Wi-Fi routers are reported to be exempt because they are made in Texas. The FCC and Executive Branch cited supply-chain and cybersecurity risks to U.S. critical infrastructure and national security, including router compromise for network access, espionage, disruption, and password-spraying activity.
MITRE ATT&CK
People
Threat Actors
Flax TyphoonThe article says Flax Typhoon was observed leveraging botnets comprising foreign-made routers to conduct cyberattacks on critical U.S. infrastructure.Salt TyphoonThe article says Salt Typhoon was observed leveraging botnets comprising foreign-made routers. It also cites a National Security Determination stating that state-sponsored actors in Salt Typhoon attacks used compromised and foreign-produced routers to gain long-term network access and pivot to other networks.Storm-0940The article says the activity involving the CovertNetwork-1658 botnet is assessed to be the work of a Chinese threat actor tracked as Storm-0940.Volt TyphoonThe article says Volt Typhoon was observed leveraging botnets comprising foreign-made routers to conduct cyberattacks on critical U.S. infrastructure.
Products
Countries
ChinaChina-nexus adversaries such as Volt Typhoon, Flax Typhoon, and Salt Typhoon have also been observed leveraging botnets comprising foreign-made routers to conduct cyber attacks on critical American communications,United StatesThe FCC has banned the import and sale of new foreign-made consumer routers, citing unacceptable supply-chain and cybersecurity risks to U.S.
Industries
CommunicationsFederal Communications Commission (FCC) said on Monday that it was banning the import of new, foreign-made consumer routers, citing “unacceptable” risks to cyber and national security.Energybotnets comprising foreign-made routers to conduct cyber attacks on critical American communications, energy, transportation, and water infrastructure.Transportationcomprising foreign-made routers to conduct cyber attacks on critical American communications, energy, transportation, and water infrastructure.waterrouters to conduct cyber attacks on critical American communications, energy, transportation, and water infrastructure.