Russian Hackers Launch Attacks on Network Edge Devices in Western Critical Infrastructure

Cybersecurity: Russian State-Sponsored Cyber Threats

Russian state-sponsored cyber actors are escalating their efforts to exploit misconfigured network edge devices across critical infrastructure in Western nations, marking a tactical evolution as 2025 concludes.

Insights from Amazon Threat Intelligence indicate that this campaign, attributed to Russia’s Main Intelligence Directorate (GRU) and the Sandworm/APT44/Seashell Blizzard cluster, has de-emphasized overt vulnerability exploitation. Instead, the focus has shifted to exploiting exposed, misconfigured devices to gain persistent access, harvest credentials, and move laterally within critical systems.

The attackers have prioritized misconfigured routers, VPN concentrators, remote access gateways, and network management appliances with exposed management interfaces. This strategy provides ongoing access to critical networks and valuable credentials while minimizing operational risk and detection exposure.

Data from Amazon reveals that from 2021 to 2025, the campaign evolved from exploiting known vulnerabilities, such as those in WatchGuard devices (CVE-2022-26318) and Atlassian Confluence (CVE-2021-26084, CVE-2023-22518), to later targeting Veeam (CVE-2023-27532). By 2025, there was a marked shift towards targeting misconfigured network edge devices, with a decrease in zero-day and N-day exploitations.

Primary targets include energy sector organizations and critical infrastructure providers across North America and Europe, as well as organizations utilizing cloud-hosted network infrastructure. Frequently targeted assets include enterprise routing infrastructure, VPN gateways, network appliances, collaboration platforms, and cloud-based project management systems.

The campaign also targets telecommunications operators and technology/cloud service providers, spanning North America, Western and Eastern Europe, and the Middle East, with a focus on the energy supply chain and its service providers.

While the exact mechanism for credential extraction has not been directly observed, indicators suggest packet capture and traffic analysis are primary techniques. Evidence includes time lapses between device compromise and authentication attempts and the use of victim organization credentials, indicating passive harvesting of authentication data.

Amazon reports coordinated operations against customer network edge devices hosted on AWS, attributing the root cause to misconfiguration rather than any AWS flaw.

Actor-controlled IPs maintained persistent connections to compromised EC2 instances running customers’ network appliance software, facilitating packet capture and data retrieval. Stolen credentials were then used to access victim organizations’ online services and infrastructure, such as authentication endpoints for energy utilities, managed security providers, and telecom operators. Although some attempts were unsuccessful, the pattern illustrates a credential replay model for follow-on access.

Infrastructure overlaps with activities reported by Bitdefender suggest a broader, modular GRU campaign. While Bitdefender highlights host-based tradecraft post-compromise, Amazon's focus is on initial access and cloud pivots, aligning with established GRU operational patterns.

In response, Amazon has notified affected customers, enabled remediation of compromised EC2 resources, and shared intelligence with vendors and partners to disrupt this activity. Organizations are advised to secure network edge devices, eliminate exposed management interfaces, enforce strong authentication and segmentation, and monitor for credential replay and suspicious authentication patterns in both cloud and on-premises services.

For AWS customers, Amazon recommends hardening IAM, tightening security groups, isolating management planes, enabling VPC Flow Logs, CloudTrail, and GuardDuty, and using Amazon Inspector for continuous vulnerability assessment to counter this persistent threat.

Based on reporting by GBHackers.