US Warns Russian Hackers Targeting Routers for Malicious Activity

Key facts

• Russian state hackers are compromising routers worldwide.
• Compromised routers are used to obscure malicious activities.
• Hackers exploit vulnerable devices using default authentication credentials.
• The Cybersecurity and Infrastructure Security Agency issued the warning.
• The advisory was co-issued by multiple allied governments.

The U.S. government has issued a warning to users of home and small office routers, urging them to secure their devices against Russian state-sponsored hackers. These actors are actively compromising routers globally to use them as proxies for malicious activities targeting sensitive organizations in both public and private sectors.

The Cybersecurity and Infrastructure Security Agency (CISA) stated that Russian Federal Security Service (FSB) Center 16 cyber actors are exploiting poorly configured and vulnerable networking devices. These groups, also known by various aliases such as Berserk Bear and Dragonfly, are enrolling compromised routers into botnets. These botnets are then used to scan IP ranges and send malicious traffic from spoofed addresses, leveraging the Simple Network Management Protocol (SNMP) on vulnerable routers to run malware.

This advisory was co-issued by cybersecurity agencies from allied nations including Australia, Denmark, New Zealand, and the United Kingdom. The practice of compromising routers for malicious purposes has been ongoing for years, with both Russian and Chinese governments engaging in efforts to control these devices. Previous efforts by governments and companies to disrupt these botnets have been described as "whack-a-mole exercises" due to the operators' ability to quickly replace compromised networks.