Russian state hackers targeted Western critical infrastructure for years, Amazon says

Amazon says its Threat Intelligence has uncovered a years-long Russian state-backed cyber campaign targeting Western critical infrastructure, running from 2021 to 2025 and with a strong focus on the energy sector. The operation evolved from exploiting vulnerabilities in WatchGuard, Confluence, and Veeam to primarily abusing misconfigured network edge devices, while zero-day and N‑day exploitation declined in 2025.

Threat actors, linked with GRU/Sandworm activity (also known as APT44 and Seashell Blizzard), carried out credential theft and lateral movement, harvesting traffic and replaying stolen credentials against victims’ online services. In many cases, the campaign involved coordinated operations against customer-hosted network edge devices on AWS, with investigators attributing a large portion of the activity to customer misconfigurations rather than flaws in AWS.

Over five years, targets included Western energy providers and other organisations with cloud-hosted networks across North America, Europe, and the Middle East. Amazon says it has disrupted active threat actor operations and will continue sharing intelligence and supporting affected customers.