Router logs (Huawei HG8145V5V3, ZTE F670L) record backdated 1981 entries, user-defined firewall rules, and rapid re-infection after reset. Independent analysis pointed to TR-069/OMCI remote provisioning.