- AWS says Russian GRU‑linked groups have spent years exploiting misconfigured edge devices to persist inside Western critical infrastructure
- Activity overlaps with Curly COMrades, whose tooling abuses Hyper‑V and Linux VMs for stealthy persistence
- Amazon urges urgent audits of edge gear, credential‑reuse checks, and monitoring for suspicious admin‑portal access
For almost half a decade, Russian state-sponsored threat actors have been abusing misconfigurations in network gear, as well as different vulnerabilities, to establish persistence in key infrastructure organizations in the west, experts have warned.
