I have a somewhat broad question related to a specific, ongoing threat that I am trying to define and defend against.
Right now, I need to rebuild a secure access point for my mobile devices and computers to connect to the Internet. I will be using a VPN, however, I am wondering about other strategies there are to defend myself. I am currently following NIST: Computer Security Incident Handling Guide to get a starting point for handling current and future incidents.
I have an internet gateway that is provided by an ISP and it has been taken over by an attacker. I believe that it initial attack vector originated from an infected USB stick. Whatever it was it now affects the gateway completely, taking over hardware context, logs and the firewall. The MAC addresses for the Ethernet inputs have changed to a weird (generic?) one and it seems to be getting attached to packets coming in and out. The MAC and log settings will not change by my attempts even with a wired connection to the administrative Ethernet socket.
The WiFi is emitting a new signal in tandem with the original and connected devices begin to emit odd packets with the above MAC address attached to it, although the device doesn't have to be using the Ethernet.
Devices: I tried reinstalling the OS on machines emitting the strange signals. Updates may also be introducing new malware and backdoors.
Gateway: Factory resets and updates do not seem to help.
Current Situation I feel targeted by the attacker as if each attack seems personal to my profession. I've filed a police report and IC3 complaint, though I wish to know if I can rebuild safely or securely with a driven and skilled attacker(s).
What I am asking
How would one create a secure build on the ISP's Gateway Unit? Would the unit need to be replaced or could there be a way to flash the firmware back to factory values?
And would there be a way to protect my devices from a malicious access point?