Forgot your password?
Close
typodupeerror
Security Government Privacy United States Wireless Networking

US Government Warns That Russia State Hackers Are Coming After Your Router (arstechnica.com) 76

Posted by BeauHD from the PSA dept.
CISA and allied governments are warning users to secure their routers as Russian state-backed hackers continue compromising the devices and turning them into proxy nodes to disguise attacks against critical infrastructure. The advisory urges users to disable outdated SNMP versions, use strong passwords, update firmware, and turn off unnecessary router services to reduce the risk of being swept into these botnets. Ars Technica reports: "Russian Federal Security Service (FSB) Center 16 cyber actors continue to exploit poorly configured and vulnerable networking devices worldwide, opportunistically compromising multiple critical infrastructure sector networks," the Cybersecurity and Infrastructure Security Agency said Monday. The hacking groups are tracked under various names, including Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard, and Static Tundra. The advisory was co-issued by governments from around the world, including Australia, Denmark, New Zealand, and the UK.

The primary means of compromise the agency warned about was hackers scanning IP ranges with active Simple Network Management Protocol (SNMP) agents that accept common or default authentication credentials. These scans are run by the very sorts of router botnets the actors are trying to enroll the targeted device in. By sending malicious traffic from spoofed addresses, the hackers can use the SNMP agent on poorly configured routers to run malware. SNMP allows users to collect and organize information about managed networking devices or to modify that information to change device behavior.

With control of a device, the hackers then use it as an exit node when probing or attacking targets in the communications, defense, energy, financial services, and government sectors. By funneling the malicious traffic through a benign-appearing device on a trustworthy IP address, the attackers are able to lower the chances of getting blocked by firewalls and other security defenses. Monday's advisory made no mention of identical operations carried out in recent years by China. So-called residential proxies are also a go-to tool used by financially motivated criminal hackers to obscure their true IP address. In many cases, these sorts of proxies are made up of millions of streaming devices that are sold with preloaded malware.
This discussion has been archived. No new comments can be posted.

US Government Warns That Russia State Hackers Are Coming After Your Router More

US Government Warns That Russia State Hackers Are Coming After Your Router

Comments Filter:

  • standard practice (Score:3, Informative)

    by DrMrLordX ( 559371 ) on Monday July 13, 2026 @06:04PM (#66237018)

    Aren't vulnerable routers the backbone of most botnets?

    • This is more about slipping through your firewall and getting unauthenticated snmp info, to learn more and eventually get to data. This is nothing new.

    • As usual:
      - install OpenWRT (be sure to purchase an OpenWRT compatible router)
      - configure it to DROP packets on closed ports (default is REJECT, that informs the 'hacker' that, while the port is closed, there is a device at this address)

      • Re:standard practice (Score:4, Interesting)

        by Bert64 ( 520050 ) <[moc.eeznerif.todhsals] [ta] [treb]> on Tuesday July 14, 2026 @10:00AM (#66237948) Homepage

        Setting the policy to DROP just means that clients will try multiple times before timing out, which means not only will you waste bandwidth with the retries, but your own clients will experience a delay while they time out instead of receiving an instant rejection.

        For legacy IPv4 networks the address space is so congested and in short supply that it's economically unviable to leave unused addresses, so you gain nothing from this. With IPv6 there might be some very limited security-through-obscurity value to someone not being able to identify a live address, but its also not practical to scan sequential address space anyway.

        What this article really highllghts however, is how flawed the perimeter security model is. Modern end user devices will actually do perfectly well on an open connection, as they don't have any externally visible services. Indeed people frequently connect their devices to public wifi networks where they are fully exposed to the network owner, other users and potentially beyond and it hasn't caused the apocalypse.

        People are relying on the perimeter security model, and then using really lousy insecure devices to actually implement that perimeter so they get the worst possible outcome. User think their devices are inside a secured perimeter when the very device supposed to be enforcing that perimeter has been compromised putting the attacker inside. These devices are often MUCH worse than today's end user operating systems.

        The proper solution is zero trust - assume your devices are fully exposed and have to stand alone.

        • Which is one of the reasons why I use pFsense as my edge router on my home network and have setup DD-WRT on my parents and sister's network.

      • OpenWRT only supports a handful of wifi7 routers. I can easily and readily use only two in my market (ASUS BT8 and the Beryl 7 travel router). Most consumers don't even know what is OpenWRT much less how to use it.

        There are nifty little $65 routers available that would probably be "okay" if remote administration were disabled immediately on installation. OpenWRT support for these devices would make them even more-desirable. Currently the standard router for OpenWRT seems to be the Slate 2, which is an o

        • Sorry Flint 2 not Slate 2. There is no Slate 2.

        • Have you seen the specs of the Flint 2 compared to other home routers?
          Anyway Flint 3 / 3e is available, and Flint 4 is upcoming.

          I use the Flint 2 and it's a beast + with its DDR4 1 GB / eMMC 8 GB (which is much more than most routers), any OpenWRT module can be installed.

          • Flint 3 is not supported by OpenWRT. And I have, its a wifi6 device that has benchmarked about as well as other wifi 6 devices. I can get a cheap wifi 7 unit that will push higher speeds for less money.

            • The 3 is Qualcomm, unfortunately. The 4 uses a MediaTek Filogic platform and should eventually be OpenWRT compatible (after release).
          • Up until a couple of months ago, I was using a 15 year old router running OpenWRT topping out at 802.11n! It finally became too unreliable - the radios would reset very occasionally at first like once a week for the longest time then several times an hour towards the end. I know Flint 2 is just a little behind the times, but it was recommended for its OpenWRT support, and anything on the market today is light years ahead of my old router.
        • This is Slashdot, if you don't know OpenWRT, you should.

          • The article isn't about us, it's about everyone else.

            • I know that recommending OpenWrt to the general public is unlikely to gain much traction, which is why I'm posting it here instead.
              Slashdot readers (and from other more technical sites) may take an interest in it and give it a try.

              • People need to temper their expectations regardless. The developers are doing their best, but OEMs are making it hard for them.

    • Re: (Score:2)

      by allo ( 1728082 )

      And IoT devices. Do you know who your light bulb is DoSing?

      • Yep, because mine are all segregated onto their own VLAN (well, more specifically 1 of either 2 VLANs depending on if an internet connection is even needed or not to control the devices). I then have my pFsense edge router denying access to many things using pfSense-ng (which is sort of like pihole, but on steroids as it not only works on the DNS lookup info, but also applies active firewall rules to block the outgoing and incoming traffic from both the DNS names but also the IP's so that a piece of softwar

  • distract - distract - distract (Score:3, Insightful)

    by sdinfoserv ( 1793266 ) on Monday July 13, 2026 @06:17PM (#66237030)
    Nothing new here, it's been going on for years. But it gives Lord Trumpkin and his butt sucking lackies another talking to point to distract from the Epstein files.

  • Shouldn't this be expected? (Score:3)

    by Gravis Zero ( 934156 ) on Monday July 13, 2026 @06:23PM (#66237040)

    Russian Federal Security Service (FSB) Center 16 cyber actors continue to exploit poorly configured and vulnerable networking devices worldwide

    My only question is why the state isn't proactively identify and deactivating such devices. Seriously, if your shitty device is a threat then I see no reason that it cannot also be forcibly taken offline. People will not give a damn about security no matter how much you implore them (they haven't for decades), so it's time for the stick.

    • Re:Shouldn't this be expected? (Score:4, Informative)

      by sarren1901 ( 5415506 ) on Monday July 13, 2026 @06:43PM (#66237064)

      Don't the ISPs own the wires? If so, then I would expect the state to first tell the ISP to clean up their properties. Have them show due diligence in getting their customers to update or replace (with what, from who?) their router before eventually kicking it off the network.

      My last cable ISP supplied a router/modem combo that they could configure to be secure by default. For the most part, it was. It didn't have a lot of features and I didn't care for it's overall design but it did work.

      My current ISP is starlink and they provide the receiver and router as well.

      I imagine the vast majority of router's that are Internet/ISP facing are issued by ISPs themselves as your average user doesn't go buy their own. Even us nerds, we buy our own but depending on our ISP, it's still behind their router/modem device in the path from client to Internet.

      So if ISPs are issuing the majority of devices, it would make the most sense for the state to be working with these ISP on updating the default settings and pushing out updates or otherwise helping customers update their gear. Let's hop to it people!

      • Re: (Score:2)

        by PPH ( 736903 )

        Even us nerds, we buy our own but depending on our ISP, it's still behind their router/modem device in the path from client to Internet.

        In which case, the most an ISP can do if they detect an unsecured device on the customer side of their modem is to cut off service.

        Lots of Windows systems will be going dark soon. Too bad you didn't upgrade when the latest OS release came down the pipe. Your new system will be available as soon as we find some DRAM.

      • Re: (Score:2)

        by AmiMoJo ( 196126 )

        Aren't the ISPs motivated to fix their shit anyway? If their customers become part of a botnet, there is a good chance that their network will get blacklisted.

        • Re: (Score:2)

          by Bert64 ( 520050 )

          Many simply don't care.
          A lot of ISPs especially in Asia use CGNAT and/or rapidly rotating IPv6 and then do nothing about abuse so the address space is widely blacklisted.

          In other countries ISPs aren't forced to use CGNAT, and use at least sticky if not fully static addressing so if customers get themselves blacklisted the ISP generally doesn't need to care as it won't affect other users.

    • It seems like government overreach to go after commercial routers. National security has to be related to the military or government in some way. Their systems should stop the bots rather than banning commercial routers. They have no right to simply declare certain routers to be insecure. Companies can corruptly bribe an administration to allow their routers and block their competitors.

    • Re: (Score:1)

      by Anonymous Coward

      The psy-ops guys would have a field day with that. "OMG, the US government is killing your internet". It also opens up a can of worms. Next stop after that is NAC, where to be allowed onto an ISP, your router has to pass measured checks... which means no F/OSS routers, but closed source, jailbreak-proof ones... and NAC can easily turn from "checking for latest OS" to active filtering and logging with MITM SSL interception.

    • Better would be to create regulation to ensure such devices receive security updates for a reasonable period of time and thereafter must be open sourced for community updates. Additionally, after such legally required support goes away or the device is otherwise in a permanently insecure state, replacing it by a secure device should be subsidized.

      Even better would be to enforce that all routers must support running alternative open source firmware.

    • My question is why the state is not actively deactivating Center 16. Nuke them if we must Just get them offline. Why is Russia still attached to the internet?

  • I am glad I finally retired my older Asus router last year, even though it was running a reflash, and installed a Unifi gateway at home. They seem to be very good with updates. I even turned on the Threat Detection and Blocking (Intrusion Prevention). Then also GeoBlocking (yes, I know they can work around that, but why make it easy?) The nice thing is this little box does everything I had before and TONS more, including running cameras, with no cloud-dependencies and no recurring fees.

    Alas, my contribu

    • Re:Upgrade (Score:4, Informative)

      by Kernel Kurtz ( 182424 ) on Monday July 13, 2026 @07:47PM (#66237134)

      I am glad I finally retired my older Asus router last year, even though it was running a reflash, and installed a Unifi gateway at home. They seem to be very good with updates. I even turned on the Threat Detection and Blocking (Intrusion Prevention). Then also GeoBlocking (yes, I know they can work around that, but why make it easy?) The nice thing is this little box does everything I had before and TONS more, including running cameras, with no cloud-dependencies and no recurring fees.

      Unifi has had several CVSS 10.0 vulnerabilities lately. Quite a lot of those devices are unfortunately still ending up part of botnets.

      https://www.bleepingcomputer.c... [bleepingcomputer.com]

      And a new one last week...

      https://thehackernews.com/2026... [thehackernews.com]

      Nice hardware, but the cloud services bring their own risks.

      • >"Unifi has had several CVSS 10.0 vulnerabilities lately. Quite a lot of those devices are unfortunately still ending up part of botnets. "

        All platforms have vulnerabilities, unfortunately. But from what I can tell, all of those are from the inside. Not from the outside. Every one of them is "with access to the network." So these are not things that are going to give outside attackers the direct ability to break into a Unifi controller on the outside of its firewall.

        • I think the issue is a lot of them have remote management exposed to the internet. My understanding is that if you disable that some of the cloud services may complain and/or not work so many people don't, but that's just anecdotal, I don't have one.

          https://www.bleepingcomputer.c... [bleepingcomputer.com]

        • Re: (Score:2)

          by Bert64 ( 520050 )

          There are hundreds of ways an attacker could gain access to the inside interface, even doing so blindly via xsrf where you have predictable legacy addressing.

      • Well, last week's look like they had already been fixed in prior patches. For example, I think they released OS v5.1.21 the day before this came out, and the vulnerabilities were patched in 5.1.19.

        They have a solid auto-updater and don't slouch when it comes to patches.

  • really and truly don't care (Score:1)

    by Anonymous Coward

    There are two countries I am NOT worried about and that is Russia and China, because whatever they find out about me they won't give to the USA. The USA on the other hand will abuse all the information they can get to deprive me of my liberties.

    Anyway sounds like "the lady doth protest too much" to me. As a good loyal subject I'll be sure to replace my router with one with NSA-approved(R) firmware, right away, sir.

    • Re: (Score:2)

      by Bert64 ( 520050 )

      There have been numerous recently reported cases of russians gaining access to information on ordinary ukrainian citizens, and then blackmailing them to carry out spying or sabogate operations.
      You absolutely do have to worry about what hostile foreign governments might do.

  • So, just how are ISP customers, which are provided routers by their ISP, supposed to do this? Shouldn't it be mandated that ISPs are responsible for updating and securing routers? I realize that some ISP customers are tech saavy and wish to configure the routers themselves. For those users a simple opt-out will do. For the remaining 99.999% of users the ISP should be handling this, right?

    • Re: (Score:2)

      by ebcdic ( 39948 )

      For the ISP to "update and secure" my router it must be accessible from outside. That's exactly what I don't want.

      • Re: (Score:2)

        by Bert64 ( 520050 )

        You shouldn't be relying on perimeter security anyway, every device should be able to stand on its own in a zero trust scenario.

      • Yes, you are a tech savvy router owner. However, the other 99.999% of owners are not. This is why I believe ISPs need to be held accountable for the routers they provide their customers. There should be an area on the customer's bill showing the security status of the router as well as any updates or changes made to the router by the ISP. This would not only inform the customer of their security status but also give any tech working on your network a complete history of revisions made to the router. This sh

  • We were doing this decades ago :
    https://www.businessinsider.co... [businessinsider.com]

  • I don't have time to keep track of security updates for my router, apply them, and check now and then to make sure it hasn't been compromised. Comcast has the infrastructure and people to do it all themselves. I don't have to think about it at all.

    Of course it's probably the only thing Comcast can do right, but I think most people on Slashdot have heard that story a million times so I won't go there!

    • Don't put too much faith into their "Security Edge". I was talking to a tech a couple months ago who told me he usually uninstalls it because it's broken.

  • That's what I get when trying to access www.cisa.gov from Firefox (currently supported ESR version). Of course it works fine in web browsers from deep-pocketed cowtowing corporate companies. Makes you wonder. Hmmm.

  • SNMP? (Score:3)

    by Todd Knarr ( 15451 ) on Monday July 13, 2026 @10:32PM (#66237294) Homepage

    Any router running SNMP or a web interface configured to listen on the external (WAN) port should be considered defective and replaced (or reflashed to sane non-braindead firmware). Home networks don't need SNMP at all, and business networks not using enterprise-grade equipment probably don't need it with write enabled. The only access to the router from the WAN side should be SSH using public-key authentication, and that only if you absolutely need it (you probably don't). That solves the vast majority of problems.

    • Home networks do need SNMP. How else would you know that your network printer is running low in ink?

      A lot of home automation equipment also uses SNMP, although MQTT has become more popular in recent years.

      The router not having ports of its own open on the internet side seems reasonable, but ISPs want to be able to remotely configure their modem routers at their customers.

      The best way to hijack a router is from the internal side anyway. JavaScript in web ads can do wonders.

  • DOH - don't connect your critical infrastructure directly to the Internet - DOH
  • ...but im going to go ahead and be more worried about one of the US governments 17 intelligence agencies sucking up all my data and storing it in a Utah data center until they feel like prosecuting me for something while lying to anyone with a concern about their intent. Thomas Drake, Mark Klein, and Edward Snowden amongst many others deserve medals.
  • During their bromance, didn't Putin and Trump agree to some kind of "no hacking each other policy"?
  • They will be used to target the US.... Maybe I should remove my password.

  • the hypocrisy...

  • This has got to be a REALLY small attack surface, right? I mean, first we have to exclude all the routers behind CGNAT since there should be no way to get to the SNMP port unless the carrier is doing a port forward for SNMP... which would be super weird. Then exclude 90% of all consumer-grade routers because most of them don't have SNMP capability or don't have it enabled, and even if so then it'd have to be a really idiotically set up router to not have that isolated only to internal network interfaces or

    • Re: (Score:2)

      by Bert64 ( 520050 )

      Assuming that CGNAT makes you immune is a huge error.
      Once you compromise a single customer you're now inside the CGNAT pool, where you will see lots of very vulnerable devices because they were left vulnerable on the assumption that they were not reachable. In an ISP with thousands of customers, at least a handful will have some infected devices.

      Modern Windows devices absolutely do not become compromised via inbound connections to open ports, they become compromised via vulnerable client software or user er

  • The routers found with the issues so far...drum-roll...."mainly Cisco and Netgear devices that had reached their end of life"....

    Meanwhile Netgear was the first company to clear the ban?...... Netgear says: Welcome to your requested the backdoor NSA ... ;P

  • Your ISP router / modem should be locked into a bridge mode, and nothing else. Buy a proper firewall / gateway, or build one, and lock that down as tight as a nuns nasty. Your ISP is not giving you a quality, robust, performant, and secure solution (*), they're giving you a mass market, cheap, non-QC'd, disaster of a shit show, that has more holes than swiss cheese.

Slashdot Top Deals

We can defeat gravity. The problem is the paperwork involved.

Close