US Agencies Warn of Russian Hackers Targeting Small Office and Home Routers

Federal authorities in the United States have issued a fresh advisory regarding the security of networking hardware used in homes and small businesses. The warning highlights ongoing efforts by state-sponsored Russian operatives to compromise these devices. By taking control of vulnerable routers, these actors aim to mask their traffic and launch attacks against sensitive targets in both the public and private sectors.

The Cybersecurity and Infrastructure Security Agency (CISA) stated that cyber actors associated with the Russian Federal Security Service (FSB) Center 16 are actively exploiting poorly configured networking devices. These groups are tracked under multiple monikers, including Berserk Bear, Energetic Bear, and Dragonfly. The advisory was a coordinated effort, released alongside government partners in the UK, Australia, Denmark, and New Zealand.

This threat is part of a broader pattern of geopolitical cyber conflict. Both Russian and Chinese state-sponsored groups have spent years wrestling for control of endpoint networking equipment. While US agencies have previously executed covert commands to disinfect compromised devices, hackers often quickly rebuild their botnets to replace lost infrastructure.

Technology firms have also been drawn into the fight to disrupt these proxy networks. Alphabet Inc., through its cloud security division, has worked to dismantle large residential proxy networks controlled by malicious actors. Despite these interventions, security researchers describe the situation as a persistent game of “whack-a-mole,” where operators rapidly spin up new botnets after old ones are taken offline.

Compromised routers serve as a critical tool for hackers because they allow attackers to obfuscate the origin of their traffic. By routing malicious activity through legitimate consumer or small business IP addresses, state-sponsored groups can more easily evade detection while targeting critical infrastructure sectors.

What to watch

• Guidance from CISA and the FBI regarding specific router firmware vulnerabilities.
• Security advisories from major networking hardware manufacturers regarding patches.
• Reports from cloud providers regarding the disruption of future botnet operations.

Source: original release