Sandworm’s Tactical Pivot: Russian GRU Abandons Zero-Days to Weaponize Misconfigured Edge Devices

According to Amazon Threat Intelligence, Sandworm, a group linked to Russia’s GRU, has shifted from exploiting complex software flaws to weaponising misconfigured edge devices, a tactical pivot disclosed in a report on 17 December 2025. The operation focuses on unpatched or poorly secured routers, VPN concentrators and network management appliances to breach critical infrastructure across the West, allowing credential harvesting and lateral movement with a smaller footprint than traditional zero-days.

Researchers note that the actors prefer targeting the “low-hanging fruit” of misconfigured devices with exposed management interfaces, enabling persistent access while avoiding expensive exploit development. Once inside, the group is reported to use native packet capture to passively intercept authentication traffic, with credential replay attacks against victim services to reach cloud collaboration platforms and project management systems.

The campaign appears to have a broad footprint, emphasising energy and telecommunications sectors across North America, Europe and the Middle East, and is linked with both Sandworm and a Bitdefender-tracked cluster called “Curly COMrades.”