Lumen details how malware bricked 600K+ routers connected to an autonomous system number belonging to a US ISP in October 2023; the ISP seems to be Windstream
Executive Summary — Lumen Technologies' Black Lotus Labs identified … Christopher Bing / Reuters : Hundreds of thousands of US internet routers destroyed in newly discovered 2023 hack Pierluigi Paganini / Security Affairs : Over 600,000 SOHO routers were destroyed by Chalubo malware in 72 hours Jess Weatherbed / The Verge : 600,000 routers were bricked in a single cyberattack Laura / SC Media : Over 600K US routers compromised in 2023 malware attack Cynthia Brumfield / Metacurity : Massive Cyberattack in America's Heartland Disabled Over 600,000 Routers Hilbert Hagedoorn / Guru3D : 600,000 Routers got Bricked After Cyber Attack on Windstream (ISP) GIGAZINE : Malware attack ‘Pumpkin Eclipse’ that destroyed 600,000 routers in just three days revealed Jonathan Bennett / Hackaday : This Week in Security: Operation Endgame, Appliance Carnage, and Router Genocide Joe Supan / CNET : Over 600K Routers Were Hacked in Three Days Late Last Year. Here's What Happened and How We Can Learn From It Ernestas Naprys / Cybernews.com : Massacre of WiFi routers leaves 600,000 American families offline Ionut Arghire / SecurityWeek : Mysterious Threat Actor Used Chalubo Malware To Brick 600,000 Routers Bill Toulas / BleepingComputer : Malware botnet bricked 600,000 routers in mysterious 2023 attack Jessica Lyons / The Register : Mystery miscreant remotely bricked 600,000 SOHO routers with malicious firmware update CircleID : Mystery Malware Takes Down 600,000 Windstream Routers in Coordinated Attack Mastodon: Ian Campbell / @neurovagrant@masto.deoan.org : Oh this new one from @dangoodin is wild. Connects the dots between a great report from Lumen on an unnamed destructive event and the real-world happening that bricked 6-7 figures of an ISP's home routers. — https://arstechnica.com/... Dan Goodin / @dangoodin@infosec.exchange : One day last October, subscribers to an ISP known as Windstream began flooding message boards with reports their routers had suddenly stopped working and remained unresponsive to reboots and all other attempts to revive them. … LinkedIn: Ryan English : Our latest report is a little different from most of the research Black Lotus Labs has released. In it, we detail a serious and rare form of network attack … Forums: Hacker News : Mystery malware destroys 600k routers from a single ISP during 72-hour span r/cybersecurity : Mystery malware destroys 600,000 routers from a single ISP during 72-hour span r/technology : Mystery malware destroys 600,000 routers from a single ISP during 72-hour span | An unknown threat actor with equally unknown motives forces ISP to replace routers Ars OpenForum : Mystery malware destroys 600,000 routers from a single ISP during 72-hour span
Context & Ripple Effects
Lumen Technologies' Black Lotus Labs attributes a concentrated October 2023 disruption to Chalubo, with the affected network reportedly associated with Windstream. The account turns a large outage into a concrete example of destructive compromise at the consumer-router layer.
The incident belongs to a longer record of router-targeting malware, from BrickerBot attacks designed to disable insecure IoT devices to cross-platform malware that used routers as an entry point. Its distinguishing feature is the reported scale of irreversible device loss rather than merely unauthorized access.
First-order effects
- Customers using the affected SOHO routers faced loss of connectivity and likely needed device replacement or reprovisioning; the implicated ISP faced restoration, support, and incident-response demands.
- The reported 72-hour destruction of more than 600,000 devices makes router fleet recovery—not just malware removal—the immediate operational problem for the provider and its suppliers.
Second-order effects
- ISPs and router vendors have a stronger incentive to identify remotely reachable, poorly protected devices and to test whether compromised units can be securely reset or recovered at scale.
- Support and replacement costs can shift the economics of low-cost customer-premises equipment, favoring managed deployments and hardware with clearer lifecycle and recovery controls.
Third-order effects
- If destructive router campaigns recur, recoverability becomes a procurement criterion alongside price and throughput: providers will need to assess replacement logistics, secure update paths, and fleet-level isolation before deployment.
- The broader risk is that consumer access networks become a high-impact attack surface where a single malware campaign can create physical-equipment-like outages; the evidence here does not establish how broadly that pattern will spread.
The trend: Destructive malware is pushing ISPs to treat customer-premises routers as managed, recoverable infrastructure rather than disposable edge hardware.