The DNSChanger campaign named GhostDNS appears to be starting from September 20, 2018, and it grows significantly by adding a bunch of new scanners. The campaign attempts a brute force on the routers web page or bypass authentication using dnscfg. The malicious campaign primarily focuses on Brazil, according to Netlab’s report more than 100k+ routers infected (87.8% located in Brazil), and 70+ router/firmware have been involved, and 50+ domain names such as some big banks in Brazil and even Netflix.”]
Source: https://gbhackers.com/hackers-hijacked-100000-routers/