Russia’s GRU Tied to Critical Infrastructure Cloud Breaches

Zero-days are nice – but all a hacker needs to convert a router or VPN concentrator into an open conduit is a bit of careless system administration, warns threat intel tracking Russian nation-state activity.

See Also: Corelight’s Brian Dye on NDR’s Role in Defeating Ransomware

In an ongoing campaign active since 2021, Russian hackers have sought out enterprise routers and infrastructure, VPNs, network management appliances and collaboration platforms used by electric utilities and energy providers in North American, Western and Eastern Europe, and the Middle East, says a Monday security alert issued by Amazon Web Service’s threat intelligence group. Other top targets include telecommunications firms and a variety of other types of critical infrastructure providers.

Researchers attribute these cyber operations to the GRU, the Russian military’s foreign intelligence agency. The attribution is based on attacker telemetry previously tied to the hacking group popularly known as Sandworm, also tracked as APT44 and Seashell Blizzard. The operations additionally have elements of tradecraft codenamed “Curly COMrades” by Bitdefender, and may involve multiple GRU teams operating together.

Russian hackers in the campaign detailed by AWS initially relied on zero-days and known vulnerabilities to gain entrance to networks. But they steadily decreased their focus on vulnerabilities over the past five years and increased targeting of device misconfigurations, said CJ Moses, CISO at Amazon Integrated Security, who previously led the FBI Cyber Division’s technical analysis of computer and network intrusions.

“This tactical adaptation enables the same operational outcomes, credential harvesting and lateral movement into victim organizations’ online services and infrastructure, while reducing the actor’s exposure and resource expenditure,” he said.

Amazon threat intel identified the campaign in part based on attackers breaching customers’ network edge devices hosted on AWS. “This was not due to a weakness in AWS; these appear to be customer misconfigured devices,” Amazon’s report says.

Successful attacks resulted in attackers gaining persistent access to a victim’s EC2 – for Elastic Compute Cloud – instance that operated network appliance software. Amazon said hackers stole data including credentials that attackers use for replay attacks – meaning, taking intercepted data and feeding it to another system to gain access.

Amazon said it notified targeted customers and helped them remediate compromised EC2 instances. The cloud giant also published indicators of compromise tied to the attacks as well as a list of “immediate priority actions for 2026.”

Those priorities include auditing “all network edge devices for unexpected packet capture files or utilities. Users should ensure strong authentication by turning on multifactor authentication and turning off default credentials. Keep management interfaces on an isolated network segment and look for signs of credential replay attacks. Monitoring for unusual access to router or appliance administrator portals and review logs for signs of the published IOCs, AWS said (see: Hacker Tactics: Exploiting Edge Devices, Missing Multifactor).

Attackers Abuse Virtualization Features

Bitdefender unmasked the Curly COMrades threat actor in August. Its codename is based on attackers regularly exfiltrating data by using malware codenamed CurlyShell or CurlCat, which taps curl.exe – the Windows command-line executable for cURL, a tool typically used by developers and system administrators to transfer data to and from servers, often over HTTP.

“They established covert, long-term access to victim networks by abusing virtualization features (Hyper-V) on compromised Windows 10 machines to create a hidden remote operating environment,” Bitdefender elaborated in November. Hyper-V is Microsoft’s native hypervisor, designed to create virtual machines on systems that run Windows.

“By isolating the malware and its execution environment within a VM, the attackers effectively bypassed many traditional host-based EDR detections,” Bitdefender said. To block this type of activity, “EDR needs to be complemented by host-based network inspection to detect EC2 traffic escaping the VM.”