Your old internet router may be the perfect spy tool for the Kremlin.
On Monday, the US and UK warned that Russian state-sponsored hackers are exploiting unpatched and legacy routers to commit cyberespionage across the world.
Targets include governments, businesses, critical infrastructure providers and ISPs, the US Department of Homeland Security, the FBI, and the UK's National Cyber Security Centre said in a joint technical alert.
The FBI has "high confidence" that Russian state-sponsored agents are behind the scheme, but declined to offer explicit evidence. Nevertheless, the hackers have been stealing intellectual property from victims and laying the foundation for potential future attacks, the alert said.
British officials also told Reuters that "millions of machines" have so far been targeted. Routers used by businesses big and small, as well as consumer routers, were ensnared in the global spying operation.
"The current state of US network devices—coupled with a Russian government campaign to exploit these devices—threatens the safety, security, and economic well-being of the United States," the alert warns.
Monday's technical alert refrained from naming any specific router brands. The larger problem is how many of these network devices are often installed and simply forgotten, leaving them unpatched and open to attack.
By exploiting a vulnerable router, a bad actor can monitor, modify, or control the internet traffic that passes through. That makes them ideal targets for tampering. In this case, the hackers have been using the attacks to harvest login credentials and redirect victims to websites secretly under their control.
Both the US and UK issued the warning a month after the White House blamed Russia for attempting to hack the US's critical infrastructure, including the electric grid.
"We do not make this attribution lightly and will hold steadfast with our partners," FBI deputy assistant director Howard Marshall said in a statement.
So far, Russia hasn't responded, but the country has routinely denied sponsoring hacking attempts against the US.
Monday's technical alert seeks to warn the entire industry, including manufacturers, to take steps to ward off the threat. US authorities are urging vendors and ISPs to move away from unencrypted technologies and to also better roll out security patches for their devices.