Router Hacking

Hello. I am at the end of my rope and really need some help.  On February 20, 2022 my android phone was hacked. My antivirus picked it up and with it, it brought updates for applications I didn’t even have. Nefarious permissions like read data, Extract data, admin over my Bluetooth, admin over my Wi-Fi, ability to read and write things into the phone, etc.

 I have since then been through 5 phones and 5 routers because this hacking has followed me from device to device. For the life of me I could not figure out how or what was happening. I have six level 2 security tickets and basically had to figure out what was going on without any network and cyber security experience whatsoever. 

What I have uncovered is that this issue is in my router and the existing settings somehow remain there even with new routers. 

I have noticed that when installing a new router that there was some unrecognized devices on my app even before plugging the new router in. An ASUS device, and four Intel devices. I was ON THE PHONE with Xfinity during one of these occasions and the young lady thought it was strange and said she would escalate it. 

The next two times a technician came to me. The first one saw the devices out there even BEFORE the new router was plugged in, again. and said it was over his head. The next guy after that said it sounds like spyware of some sort. I thought having a technician would help matters - but they are not well versed in this area and advised I call the security team. The folks that came out were as helpful as they could possibly be but were unable to help with this.

I have went down a rabbit hole of learning what could go wrong and after two months, I have discovered the issue in my network. Somehow, it appears that my routers are being cloned along with device IP information, and that settings on said router (or line) are carrying over to each device. 

there are open ports, port forwarding, UpNP service enabled, Apache Web Services on port 8080 and some sort of sub network set up? “C” network using 10.0.0/24 instead of 10.0.0.1

To my understanding- an Xbox One and Roku TV are somehow being used to mirror every move I make.

I authorized none of this. I don’t know how to log into my router and fix this. I can log in, but I don’t know what to do to fix this from there. I also notice that there is activity on my event logs that I did not do. My devices have been cloned so it appears as if the changes are coming from ME. 

Whoever is doing this is a step ahead all the time - they are using keyloggers of sorts and know all of my password changes as I make them. 

I have been bounced around from tech support and security team to get some guidance on this and no one has the knowledge to assist. This has impacted my life to a great magnitude personally and professionally. I am having trouble understanding why there is no one that can assist. I’ve also been to Apple Support, other phone providers , manufacturers, the police to no avail. 

The Xfinity app on my phone is also spoofed. My internet is censored.  It says I don’t have port forwards when I do. I get redirects and syncs on most websites. I am worried this will be intercepted too like many other attempts at obtaining help. This is way over my head. The hacker doing this knows what I’m going to do before I do. I have many pieces to this puzzle, just not the knowledge to put it together. Any safety software I use gets exploited like Xfi, Malwarebytes, Norton and VPNs. It’s a plot tunnel with two devices every time. 

Please direct me to someone qualified to assist me. Someone who knows what questions to ask. With all of the technological vulnerabilities and the state of the world we are in - it is very concerning that there isn’t someone who CAN have a conversation or look into this!!

I have emailed abuse email almost two weeks ago multiple times and have not heard back. As concerning as that is, I am wondering if it ever made it to your actual inbox. Whatever is hacking me has made it very hard to seek assistance from anyone. You can look at my call history as well. I have called and called. I would not like to think that you guys would drop the ball on something like this. Things are happening with my technology that have never happened before. Please assist? I feel as if my safety is at risk and no one is helping.