Amazon: Russian Hackers Now Favor Misconfigurations in Critical Infrastructure Attacks

On 16 December 2025, SecurityWeek reports that after years of exploiting zero‑day and n‑day vulnerabilities, Russian state‑sponsored threat actors are shifting to misconfigured devices for access to critical infrastructure, according to Amazon’s threat intelligence team. The activity has been linked to the Sandworm group, with Amazon’s experts concluding the attacks are likely conducted by hackers associated with Russia’s GRU military intelligence agency.

The attackers have been seen targeting enterprise routers, VPN concentrators and remote access gateways, collaboration platforms, network management appliances and project management systems, often via misconfigured edge devices hosted on AWS. Amazon notes that the same operational outcomes—credential harvesting and lateral movement—are achieved while reducing exposure and resource expenditure.

Historically, exploits cited include CVEs such as CVE-2022-26318, CVE-2021-26084, CVE-2023-22518 and CVE-2023-27532, but since 2025 there has been a decline in vulnerability exploitation in favour of misconfigurations. The threat actors’ use of native packet‑capture capabilities to intercept traffic and collect credentials has facilitated replay attacks and further movement within victims’ online services and infrastructure.