Security
US warns of Russian state hackers targeting home routers to build covert networks
Federal authorities flagged an ongoing campaign by Russian intelligence operatives to seize residential and small-business routers as proxy nodes for launching attacks on critical infrastructure.
Ars Technica
American officials have issued a public alert about coordinated efforts by Russian state-sponsored hackers to seize control of consumer and office routers, which they repurpose to mask attacks against government and commercial targets with sensitive operations.
The battle for router networks represents a long-standing cat-and-mouse game between adversaries. Both Russian and Chinese intelligence services have been systematically compromising routers for years, sometimes competing to control the same devices after one nation displaces another's malware. The US has occasionally deployed covert countermeasures, while tech giants like Google have disrupted major botnets that operate these hijacked devices—yet operators quickly rebuild their infrastructure, making cleanup efforts largely futile.
How the attacks work#
The Cybersecurity and Infrastructure Security Agency (CISA) detailed the threat in a Monday advisory, noting that Russian Federal Security Service operatives—tracked under names such as Berserk Bear, Energetic Bear, Ghost Blizzard, and Static Tundra—exploit poorly defended networking equipment globally. The warning was jointly issued by cybersecurity authorities from Australia, Denmark, New Zealand, and the UK.
The primary attack vector exploits misconfigured Simple Network Management Protocol (SNMP) services on routers. Hackers scan IP address ranges looking for SNMP agents that accept weak or default login credentials, then use botnets to send malicious traffic from forged sources, allowing them to execute code and enlist the device in their network.
Why routers are attractive targets#
These compromised routers serve as proxy networks—infrastructure that conceals the true origin of cyberattacks against critical sectors. By routing malicious traffic through thousands of consumer devices, attackers obscure their identity and complicate attribution, making defense efforts considerably harder for security teams protecting essential services.
