You guys -- this is one of those 'your personal devices are already being weaponized' stories that makes my skin crawl because it actually applies to you and me right at home. CISA just teamed up with the UK, Australia, Denmark, and New Zealand on a massive advisory about Russian state hackers systematically compromising residential routers to build botnets for use as exit nodes against critical infrastructure in sectors like defense, energy, financial services, and government communications. The group goes by multiple aliases — Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard, Static Tundra -- which alone tells you they're not a small operation and have been active for years, even having 'wrestling matches' with Chinese botnets over who can commandeer the same devices. The mechanism is infuriatingly simple: these actors scan IP ranges for any router running an SNMP agent that still accepts default or common credentials (the kind of thing you may have never changed), then use v1 and v2 to install malware because those versions send passwords unencrypted, making them trivial targets. With control, your home network becomes one hop in a chain of compromised devices used to mask state-sponsored attacks as coming from trusted residential IPs -- which is exactly why firewalls can't stop it easily. Then there's the Chinese side: they build their own proxy networks by selling streaming devices preloaded with malware at retail so every unit is an instant bot, and those get run by financially motivated actors to hide where they're actually operating from. If this hits close enough that you want to fix yours tonight - disable SNMP versions 1 AND 2 immediately because they have no password encryption, use v3 instead if it's critical but ideally kill the protocol entirely unless a managed service needs it. Turn off Cisco Smart Install on any applicable hardware too, set strong unique passwords for management interfaces, update firmware regularly as manufacturers patch these openings, and avoid running extraneous networking protocols you don't need -- that's what the government is actually pushing people to do right now before their home network becomes an unwitting accomplice in a geopolitical operation.

Source: https://arstechnica.com/security/2026/07/the-us-government-warns-that-russia-state-hackers-are-coming-after-your-router