Russian hackers targeted internet routers worldwide in apparent spy campaign, say U.S. and U.K.

The U.S. and Britain are issuing a joint alert that Russia-backed hackers are targeting internet routers used by offices and residences worldwide.

Hackers backed by the Russian government carried out a coordinated campaign against internet traffic routers used in small offices and residences worldwide, cybersecurity officials from the U.S. and U.K. said Monday.

The hackers targeted network infrastructure in the public and private sectors with the potential goals of espionage and the theft of intellectual property, the officials from the White House, Department of Homeland Security, FBI and Britain’s National Cyber Security Centre (NCSC) told reporters.

It’s the first time U.S. and British governments have issued such a joint alert. The announcement comes as Western countries continue to sound the alarm about Russian cyber-aggression. The U.S. sanctioned several Russian oligarchs earlier this month in part because of that country’s malicious actions in cyberspace.

The alert was pre-planned and the U.S. and U.K. have been coordinating its release for a long time, the officials said. NCSC head Ciaran Martin said that the British agency has been tracking the hacking campaign for about a year, and the groups behind the campaign for longer than that.

Organizations targeted in the hacking campaign included government and private sector organizations, critical infrastructure owners and operators, and internet service providers supporting those sectors, the officials said.

No zero-days needed

The U.S. government received information from multiple sources since 2015 indicating that Russian hackers are exploiting such routers, according to a joint report released the U.S. Computer Emergency Readiness Team (US-CERT) after the call.

The hackers don’t need to use zero-day vulnerabilities or install malware on the routers, the report says. Instead, they exploit devices with outdated, unencrypted protocols or unauthenticated services; misconfigured devices; and devices no longer receiving security patches from their manufacturers.

US-CERT says Russian hackers conducted “broad-scale and targeted scanning of Internet address spaces” to search for devices with such weaknesses. From there, they can use the discovered weak devices to extract information critical to the security of a network, such as vulnerable devices and login credentials.

The report also includes guidance on how network operators can mitigate some of the weaknesses agencies identified.

The officials did not specify how U.S. or U.K. agencies have responded to the hacking campaign, but White House Cybersecurity Coordinator Rob Joyce said that “when we see malicious cyber-activity, whether it be from the Kremlin or other nation-state actors, we’re going to push back.”

Joyce said that the campaign is not an isolated incident and should be viewed in context of past Russian cyberattacks. The goal of the hacking campaign, he said, is not necessarily to steal information from the penetrated networks. The intrusions could be leveraged for future operations.

“We can’t rule out the possibility that Russia may intend to use this set of compromises for future offensive cyber-operations as well. It provides basic infrastructure that they can launch from,” Joyce said.

Officials said the affected hardware includes common routers used in small offices and home offices, known as SOHO routers, as well as residential routers.

“Most traffic within an an organization or between an organization and externally must traverse these types of devices. So when a malicious actor has access to them, they can monitor, modify, or deny traffic,” said Jeanette Manfra, a top cybersecurity official in DHS’s National Protection and Programs Directorate.

Martin said the U.K. corroborated the U.S.’s assessment of the campaign and confirmed that it affected the U.K.

“This is a significant moment in the transatlantic fight back against Russian aggression in cyberspace,” Martin said.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure