The routers, mostly by Cisco and Netgear, were vulnerable because they were so old they were no longer receiving routine security updates from their manufacturers. Once in the hackers’ control, the routers functioned as stepping stones to other targets.