The US government warns that Russia state hackers are coming after your router

Key Points:

• The US federal government warns that Russian state hackers are mass-compromising home and small office routers to obscure malicious activities targeting sensitive public and private sector organizations.
• Russian hacking groups, including Berserk Bear and Energetic Bear, exploit poorly configured routers by scanning for devices with active SNMP agents using default credentials, then use these devices as proxy exit nodes to evade security defenses.
• The compromised routers funnel malicious traffic through trusted IP addresses, making it harder for firewalls and security systems to detect attacks on critical sectors such as communications, defense, energy, finance, and government.
• The advisory, co-issued by multiple governments, recommends disabling SNMP versions 1 and 2 due to their lack of encryption, using only SNMP version 3 or disabling SNMP entirely, along with other measures like disabling Cisco Smart Install, using strong passwords, and regularly updating firmware.
• While the warning focuses on Russian operations, similar tactics have been employed by Chinese hackers and financially motivated criminals using residential proxies made up of infected streaming devices.