My mate noticed that a widely-used brand of modem/router seems to have a pattern for the default passwords.

His ships with a default that's 5 letters, 4 numbers, 5 letters. All letters lowercase.

Running an appropriate mask for that through hashcat would be ?l?l?l?l?l?d?d?d?d?l?l?l?l?l?...