U.S. and U.K. say Russia targeted network infrastructure worldwide

The United States and Great Britain are publicly accusing Russia of undertaking a coordinated campaign to target and compromise home office and residential routers, switches and other network infrastructure devices around the globe.

According to officials, the campaign, which involved a range of Russia- aligned cyber entities, used a series of exploits to target millions of devices around the world and that “sustained targeting” of government networks and critical infrastructure entities was apparent. White House Cyber Coordinator and acting Homeland Security Advisor Rob Joyce said the campaign has been ongoing for more than a year, and that targets include Internet Service Providers, government networks, private-sector firms and critical infrastructure providers.

While the attacks did target the critical infrastructure sector, officials said they have not witnessed an effort to go after election officials or the systems they use.

“This activity isn’t always to steal information from the network targeted in these operations,” said Joyce. He such efforts “sometimes are used to facilitate other operations that the Russians can do against high value targets worldwide.”

The full scope and impact of the operation is not fully known, and White House and DHS officials said they were releasing the information now in the hopes that businesses and other affected entities come forward if they have witnessed similar suspicious activity. While millions of devices were targeted, Jeanette Manfra, assistant secretary for the Office of Cybersecurity and Communications at the Department of Homeland Security, said only a small number were actually hacked.

“What we can see is targeting and some compromise," Manfra said, "but we need the owners and operators of those devices and systems to work with us to determine the extent of the actual compromise.”

The announcement, made during an April 16 briefing call with reporters, was paired with a joint technical alert issued the same day by the DHS and the UK’s National Cyber Security Centre detailing the devices targeted and avenues for mitigation. Ciaran Martin, chief executive of the UK’s National Cyber Security Centre, said his country have been tracking the activity for close to a year and can independently verify the campaign and its attribution to the Russian government.

Officials said the goals for the operation were varied, including espionage and intellectual property theft, but that it also would give attackers control of the sort of basic infrastructure that might allow them to launch dedicated denial of service attacks, steal intellectual property or lie dormant to facilitate future attacks.

“For this reason, we can’t rule out the possibility Russia may intend to use these set of compromises for future offensive cyber operations as well,” Joyce said.

The announcement comes more than a month after DHS made public a 2016 report and binding operational directive warning government employees that nation states were targeting vulnerable routers and switches as agencies hardened their defenses around computers, laptops and other devices. In a 2016 letter to federal employees, then-Secretary of Homeland Security Jeh Johnson noted that “for several years now, network infrastructure devices have been the attack vector of choice” for government-sponsored hacking groups.

Manfra and others said vulnerable network devices are ideal targets because these devices are often not patched or maintained properly, and a compromise gives attackers access to most Internet traffic within an organization and the organizations it communicates with.

“Once you own the router, you own the traffic that’s traversing the router,” said Manfra.

The announcement was characterized as just one step in a series of actions planned by the U.S. and British government.

“We are looking at cybersecurity as something where we need to use asymmetric tools to respond to cyber intrusions, and that means all elements of our national power,” said Joyce. “Whether it is the ability to do deterrence by denial…whether it’s indictments, whether it’s sanctions or whether it is using our capabilities in the offensive [cyber] world.”