A joint advisory from the UK NCSC and 18 international agencies warns that Russian FSB Centre 16 cyber actors are globally exploiting poorly configured routers and network devices to target critical national infrastructure. The group uses SNMP scanning to find devices with default or weak credentials and exploits known vulnerabilities in Cisco devices and web portals to gain control. The advisory coincides with UK sanctions and formal attribution of a December 2025 attack on Poland's energy grid to the same actor.
router exploitation
2 posts
UK and Allies urge critical sectors to improve defences against Russian intelligence targeting UAT-7810 continues building ORB networks using new malware UAT-7810, a China-nexus APT actor, continues to build Operational Relay Box (ORB) networks by exploiting n-day vulnerabilities in Ruckus and ASUS AiCloud routers. Talos identified four new malware families — LONGLEASH (an upgraded multi-protocol proxy backdoor), DOGLEASH (a passive C-based Linux backdoor), JARLEASH (a Java-based administrative backdoor), and LEASHTEST (a MIPS test binary) — deployed across MIPS, ARM, and x64 platforms. The actor uses at least four new servers to host payloads and deploy DOGLEASH via shell scripts that modify iptables rules on compromised devices.
