LightSpy, a China-linked surveillance platform, has grown into an operation using at least 117 servers with verified router infections. Once a router is compromised, LightSpy can change administrator credentials and DNS settings. Control at the gateway can affect other devices using the same network. Unexplained DNS changes, altered proxy settings, or unfamiliar router scripts should put the gateway itself under scrutiny. Bestuzhev and Melikov advise defenders to review scheduled scripts and inspect DNS and proxy settings on MikroTik devices.