US Warns Russia State Hackers Targeting Routers

The U.S. federal government issued a warning this week urging users of home and small office routers to secure their devices against ongoing compromises by Russian state hackers. These compromised routers are being utilized to mask nefarious actions targeting sensitive organizations across both public and private sectors. This advisory highlights a persistent threat, as both Russian and Chinese governments have been actively compromising routers for years, engaging in prolonged efforts to gain control of devices previously commandeered by the other.

The Cybersecurity and Infrastructure Security Agency (CISA) stated on Monday that "Russian Federal Security Service (FSB) Center 16 cyber actors continue to exploit poorly configured and vulnerable networking devices worldwide, opportunistically compromising multiple critical infrastructure sector networks." These hacking groups are known by various monikers, including Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard, and Static Tundra. The advisory was a collaborative effort, co-issued by governments from Australia, Denmark, New Zealand, and the United Kingdom, underscoring the international scope of the threat.

Past efforts by the U.S. government have included issuing covert commands and implementing other measures to disinfect compromised routers. Technology companies like Google have also worked to disrupt the extensive botnets that control these compromised devices in a synchronized manner. However, these actions are described as "whack-a-mole exercises" because the operators behind the attacks simply replace compromised botnets with new ones once they are disrupted. The continuous cycle of compromise and replacement indicates a significant challenge in permanently eradicating the threat posed by these state-sponsored hacking groups.