End-of-life Cisco SOHO routers (including RV-series and Realtek RTL819X chipset-based models) are confirmed targets in two simultaneous botnet campaigns — the CSIS-disrupted state-linked Canadian botnet infrastructure and the AryStinger ORB reconnaissance campaign. No patches are available for the affected firmware versions; replacement is the only complete remediation path. These devices, when compromised, function as low-visibility reconnaissance and tunneling nodes that bypass enterprise perimeter controls entirely.