The US Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning that Russian state-sponsored hackers are actively targeting residential routers. The threat escalates as attackers seek to exploit routers for use as residential proxies.
CISA alerted the public to increased activity from Russian state-backed threat actors targeting home routers. The hackers aim to compromise these devices and repurpose them as residential proxies—a tactic that masks malicious activity behind legitimate home internet connections.
Residential proxies have become increasingly valuable to cybercriminals because they appear to originate from normal users rather than data centers, making them harder to detect and block. By hijacking routers, attackers can distribute malware, conduct fraud, launch phishing campaigns, and evade security systems with minimal detection risk.
What homeowners should do:
CISA recommends router users take immediate action:
- Update router firmware to the latest available version
- Change default login credentials to strong, unique passwords
- Disable remote management features
- Enable two-factor authentication where available
- Review connected devices and remove unknown entries
- Consider enabling firewall protections built into routers
The agency emphasized that routers are critical entry points to home networks and often receive less security attention than computers or smartphones. Once compromised, a router can give attackers access to sensitive data, personal devices, and the ability to intercept communications.
Russian state-sponsored groups have a documented history of large-scale infrastructure compromise campaigns. Security researchers have linked similar router exploitation tactics to multiple Russian threat actors operating across Eastern Europe and beyond.
Homeowners should check manufacturer websites for firmware updates and consult their router's manual for security settings. Many modern routers allow users to schedule automatic updates. Those unable to secure their devices themselves should consider consulting a cybersecurity professional or replacing older routers with newer models that receive active security support.
The warning underscores the growing sophistication of nation-state cyber operations and their willingness to target consumer-grade infrastructure for strategic purposes.
The Clop ransomware gang created a specialized Java web shell targeting PTC Windchill and FlexPLM servers. The malware includes built-in capabilities to decrypt credentials, enumerate repositories, and exfiltrate files.
France's tax authority plans to use artificial intelligence tools to identify vulnerabilities in its systems following a cyberattack that compromised personal data of hundreds of thousands of taxpayers.
Passkeys offer stronger protection than passwords, even when paired with password managers. The shift addresses fundamental vulnerabilities in traditional authentication.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed that ransomware groups are actively exploiting a high-severity Windows Task Host vulnerability. The flaw was previously flagged as under active exploitation in April.