Loading story…
Researchers reported that second-hand enterprise routers sold without proper sanitization still contained sensitive corporate data, exposing a broad operational security failure in hardware disposal practices. Devices acquired from the resale market reportedly held recoverable configuration files, VPN credentials, network diagrams, hashed or plaintext administrative details, and other internal information that could give an attacker insight into enterprise environments and remote-access infrastructure.
The findings show that organizations are retiring networking equipment without securely wiping storage or destroying components, creating a low-cost path for intrusion through leaked secrets embedded in old hardware. The exposed data could enable follow-on attacks such as unauthorized network access, credential abuse, and targeted reconnaissance, underscoring the need for verified decommissioning procedures, secure erasure, and asset disposal controls for routers and other infrastructure devices.
See attribution, scope, and your downstream exposure.
1 event from the most recent confirmed update back to the earliest known activity.
ESET published research showing that old enterprise routers obtained on the secondary market still contained sensitive corporate data, highlighting inadequate sanitization before disposal. The article brought public attention to the security risks posed by improperly decommissioned networking equipment.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks Unit 42 reported that attackers exploited vulnerable **home and small office wireless routers** and used the compromised devices as infrastructure to target **gaming servers**. The activity turned consumer and small-business networking equipment into a distributed attack platform, allowing malicious traffic to be routed through legitimate internet connections and making the attacks harder to trace directly to the operators. The report highlights how poorly secured edge devices can be repurposed beyond simple botnet activity and used to disrupt online gaming environments. For defenders, the incident underscores the need to patch router firmware, disable exposed remote administration features, replace default credentials, and monitor for unusual outbound traffic from SOHO networking equipment that may indicate compromise.
Jul 12, 2026
Investigations across multiple incidents have shown attackers gaining and maintaining access through internet-facing infrastructure, including **SonicWall SMA** devices, **Cisco AnyConnect** deployments, and **F5** systems. Truesec reported a persistent web shell on SonicWall SMA appliances, while separate reporting tied exploitation of `CVE-2020-3259` in Cisco AnyConnect to **Akira ransomware** activity. The UK **NCSC** also confirmed a compromise affecting the **F5** network, underscoring that trusted remote-access and application delivery platforms remain high-value targets for intrusion and follow-on operations. The broader pattern mirrors earlier high-impact compromises such as **SolarWinds**, where trusted enterprise technology became a pathway for stealthy access, and more recent financially motivated and state-linked campaigns, including Truesec reporting on a **North Korean threat actor** targeting the Nordic financial sector. Together, the cases show how compromise of edge devices and trusted network infrastructure can enable persistence, credential theft, lateral movement, and downstream attacks against enterprises and critical sectors.
Aug 1, 2026
U.S. government reporting says operators linked to Russia's GRU are exploiting vulnerable routers to steal sensitive information from targeted networks. The activity was highlighted in an **IC3 notice** referenced by security community reporting, which attributes the intrusions to a Russian military intelligence actor using exposed or unpatched routing infrastructure as an access point for espionage. Publicly available details in the referenced material remain limited, with no specific router models, malware families, indicators of compromise, or victim sectors disclosed in the summaries reviewed. Separate discussion in the same reporting stream noted that the **Internet Bug Bounty** program paused payouts after a surge in AI-generated vulnerability reports, but the principal security development was the government warning that compromised routers are being used for intelligence collection.
Jun 29, 2026