Cyber security agencies from Australia, the US, UK and other allied nations have jointly warned that Russian state-linked hackers are actively breaking into poorly secured business routers and network equipment.

• What it is: The Australian Cyber Security Centre, alongside the NSA, CISA, FBI and other international partners, has confirmed an ongoing campaign where attackers exploit weak or default settings on routers, firewalls and VPN devices.
• Who is affected: Any business with an internet-facing router, firewall or VPN device, particularly ones still running default passwords, outdated firmware or legacy remote-management features.
• The risk: Attackers use a compromised router as a foothold to pivot deeper into a network, steal data, or fold the device into a botnet used to attack other organisations, often without the owner ever noticing.
• What to do: Change default credentials, disable outdated management protocols such as old SNMP versions, keep firmware current, and turn off remote management features you don't actively use.

We recommend a router and firewall health check for any business that hasn't reviewed these settings in the past twelve months.