U.S. and U.K. say Russia targeted network infrastructure worldwide

malware detection (Alexander Yakimov/

The United States and Great Britain are publicly accusing Russia of undertaking a coordinated campaign to target and compromise home office and residential routers, switches and other network infrastructure devices around the globe.

According to officials, the campaign, which involved a range of Russia- aligned cyber entities, used a series of exploits to target millions of devices around the world and that “sustained targeting” of government networks and critical infrastructure entities was apparent. White House Cyber Coordinator and acting Homeland Security Advisor Rob Joyce said the campaign has been ongoing for more than a year, and that targets include Internet Service Providers, government networks, private-sector firms and critical infrastructure providers.

While the attacks did target the critical infrastructure sector, officials said they have not witnessed an effort to go after election officials or the systems they use.

“This activity isn’t always to steal information from the network targeted in these operations,” said Joyce. He such efforts “sometimes are used to facilitate other operations that the Russians can do against high value targets worldwide.”

The full scope and impact of the operation is not fully known, and White House and DHS officials said they were releasing the information now in the hopes that businesses and other affected entities come forward if they have witnessed similar suspicious activity. While millions of devices were targeted, Jeanette Manfra, assistant secretary for the Office of Cybersecurity and Communications at the Department of Homeland Security, said only a small number were actually hacked.

“What we can see is targeting and some compromise," Manfra said, "but we need the owners and operators of those devices and systems to work with us to determine the extent of the actual compromise.”

The announcement, made during an April 16 briefing call with reporters, was paired with a joint technical alert issued the same day by the DHS and the UK’s National Cyber Security Centre detailing the devices targeted and avenues for mitigation. Ciaran Martin, chief executive of the UK’s National Cyber Security Centre, said his country have been tracking the activity for close to a year and can independently verify the campaign and its attribution to the Russian government.

Officials said the goals for the operation were varied, including espionage and intellectual property theft, but that it also would give attackers control of the sort of basic infrastructure that might allow them to launch dedicated denial of service attacks, steal intellectual property or lie dormant to facilitate future attacks.

“For this reason, we can’t rule out the possibility Russia may intend to use these set of compromises for future offensive cyber operations as well,” Joyce said.

The announcement comes more than a month after DHS made public a 2016 report and binding operational directive warning government employees that nation states were targeting vulnerable routers and switches as agencies hardened their defenses around computers, laptops and other devices. In a 2016 letter to federal employees, then-Secretary of Homeland Security Jeh Johnson noted that “for several years now, network infrastructure devices have been the attack vector of choice” for government-sponsored hacking groups.

Manfra and others said vulnerable network devices are ideal targets because these devices are often not patched or maintained properly, and a compromise gives attackers access to most Internet traffic within an organization and the organizations it communicates with.

“Once you own the router, you own the traffic that’s traversing the router,” said Manfra.

The announcement was characterized as just one step in a series of actions planned by the U.S. and British government.

“We are looking at cybersecurity as something where we need to use asymmetric tools to respond to cyber intrusions, and that means all elements of our national power,” said Joyce. “Whether it is the ability to do deterrence by denial…whether it’s indictments, whether it’s sanctions or whether it is using our capabilities in the offensive [cyber] world.”

About the Author

Derek B. Johnson is a senior staff writer at FCW, covering governmentwide IT policy, cybersecurity and a range of other federal technology issues.

Prior to joining FCW, Johnson was a freelance technology journalist. His work has appeared in The Washington Post, GoodCall News, Foreign Policy Journal, Washington Technology, Elevation DC, Connection Newspapers and The Maryland Gazette.

Johnson has a Bachelor's degree in journalism from Hofstra University and a Master's degree in public policy from George Mason University. He can be contacted at [email protected], or follow him on Twitter @derekdoestech.

Click here for previous articles by Johnson.


  • People
    Federal CIO Suzette Kent

    Federal CIO Kent to exit in July

    During her tenure, Suzette Kent pushed on policies including Trusted Internet Connection, identity management and the creation of the Chief Data Officers Council

  • Defense
    Essye Miller, Director at Defense Information Management, speaks during the Breaking the Gender Barrier panel at the Air Space, Cyber Conference in National Harbor, Md., Sept. 19, 2017. (U.S. Air Force photo/Staff Sgt. Chad Trujillo)

    Essye Miller: The exit interview

    Essye Miller, DOD's outgoing principal deputy CIO, talks about COVID, the state of the tech workforce and the hard conversations DOD has to have to prepare personnel for the future.

Stay Connected


Sign up for our newsletter.

I agree to this site's Privacy Policy.