Russian Hackers Attacking Network Edge Devices in Western Critical Infrastructure

A Russian GRU-linked APT (Sandworm) has conducted a multi-year campaign (2021–2025) against Western critical infrastructure by compromising misconfigured cloud-hosted network edge devices (routers, VPN gateways, management appliances) to capture authentication traffic, exfiltrate configuration and credentials (using Fernet encryption and TFTP), and replay stolen credentials against cloud consoles and enterprise services; AWS telemetry observed persistent attacker access and credential-replay activity across energy, utilities, MSSPs, and telecoms in North America, Europe, and the Middle East.