Cyber Group Exploits Network Devices at Scale

Attackers with Russian affiliations use network-edge misconfigurations that leave Russian organizations of energy and infrastructure vulnerable to high risks of sophisticated cyberespionage.

Russian state-sponsored hackers have increased their efforts on energy firms and other companies providing critical infrastructure by taking advantage of misconfigurations in network-edge devices, as reported by Amazon Threat Intelligence. The campaign creates awareness of increasing risk in enterprise networks.

The group has been active at least since the year 2021 and has previously used well-known vulnerabilities in products of WatchGuard, Confluence, and Veeam. Nevertheless, researchers describe the strategic change in 2025 in the direction of exploiting poorly configured networking resources and not by zero-day vulnerabilities or freshly identified problems. The main targets are enterprise routers, VPN concentrators, and remote access gateway and network management appliances.

The analysis of Amazon associates the black infrastructure of the attackers with the Sandworm, or rather APT44, the terror group attributed to the Russian military intelligence agency, the GRU. It was also found to have overlaps with Curly COMrades, which did point to coordinated subgroups of access, lateral movement and persistence.

The attackers mentioned that they managed to gain continuous access to affected devices running on AWS EC2 instances and breach the credentials by stealing network traffic. This would be replayed against other enterprise services later, with the assistance of stolen credentials helping to continue the intrusion into the networks and cloud platforms.

The energy sector has been the most targeted area in this campaign, which has also extended its touch to the technology providers, telecommunications companies and managed service providers. Amazon recommends organizations cultivate networking hygiene through auditing the configuration of devices, isolating management interfaces, realizing multi-factor authentication, and watching authentication abnormalities to mitigate exposure to these types of risks.