The US government warns that Russia state hackers are coming after your router

# The US government warns that Russia state hackers are coming after your router Source: [https://arstechnica.com/security/2026/07/the-us-government-warns-that-russia-state-hackers-are-coming-after-your-router/](https://arstechnica.com/security/2026/07/the-us-government-warns-that-russia-state-hackers-are-coming-after-your-router/) The federal government is warning users of home and small office routers to secure their devices as Russia state hackers continue to mass\-compromise them for use in obscuring nefarious actions against sensitive organizations in the public and private sectors\. Both the[Russian](https://arstechnica.com/security/2026/04/russias-military-hacks-thousands-of-consumer-routers-to-steal-credentials/)and[Chinese](https://arstechnica.com/security/2024/01/chinese-malware-removed-from-soho-routers-after-fbi-issues-covert-commands/)governments have been compromising routers for years, sometimes in[prolonged tugs\-of\-war](https://arstechnica.com/security/2024/05/hacker-free-for-all-fights-for-control-of-home-and-office-routers-everywhere/)to wrest control of devices the other has already commandeered\. The US government has occasionally issued[covert commands](https://arstechnica.com/security/2024/01/chinese-malware-removed-from-soho-routers-after-fbi-issues-covert-commands/)and taken other steps to disinfect routers\. Google and other companies have also[worked](https://cloud.google.com/blog/topics/threat-intelligence/disrupting-largest-residential-proxy-network)to[disrupt](https://cloud.google.com/blog/topics/threat-intelligence/google-continued-disruption-residential-proxy-networks)the massive botnets that control compromised routers in lockstep\. The actions to date are little more than whack\-a\-mole exercises as the operators simply replace their botnets with new ones\. ## Proxy networks: The go\-to tool “Russian Federal Security Service \(FSB\) Center 16 cyber actors continue to exploit poorly configured and vulnerable networking devices worldwide, opportunistically compromising multiple critical infrastructure sector networks,” the Cybersecurity and Infrastructure Security Agency[said](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-194a)Monday\. The hacking groups are tracked under various names, including Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard, and Static Tundra\. The advisory was co\-issued by governments from around the world, including Australia, Denmark, New Zealand, and the UK\. The primary means of compromise the agency warned about was hackers scanning IP ranges with active Simple Network Management Protocol \(SNMP\) agents that accept common or default authentication credentials\. These scans are run by the very sorts of router botnets the actors are trying to enroll the targeted device in\. By sending malicious traffic from spoofed addresses, the hackers can use the SNMP agent on poorly configured routers to run malware\. SNMP[allows](https://en.wikipedia.org/wiki/Simple_Network_Management_Protocol)users to collect and organize information about managed networking devices or to modify that information to change device behavior\.