State-sponsored cyberattacks are targeting small office and home office (SOHO) routers to create a global GRU botnet. This guide reveals how the Russian APT28 group uses DNS hijacking to spy on traffic and what critical steps you must take to immunize your hardware.