Russia Hits Critical Orgs Via Misconfigured Edge Devices

Russian threat actors are conducting a multiyear campaign against critical organisations worldwide, with a notable focus on the energy sector and on organisations that rely on cloud-hosted network infrastructure. Between 2021 and 2025, the shift toward targeting misconfigured customer edge devices as the primary initial access vector has become clearer, with 2025 marked by sustained targeting of misconfigured edge devices and a decline in vulnerability exploitation.

According to Amazon, attackers have gone after enterprise routers, routing infrastructure, VPN concentrators, and other edge components, including AWS-hosted network edge devices, using credential replay attacks to access victim services. The operations, conducted on behalf of Russia's Main Intelligence Directorate (GRU) from 2021 to the present, aim to harvest credentials from compromised network infrastructure for use against victims’ online services.

Amazon’s response includes notifying affected customers, remediation of compromised EC2 resources, and sharing mitigations, while four priority actions were recommended to organisations, emphasising auditing edge devices and monitoring for credential replay attacks.