Espionage by the path of least resistance: devices nobody treats as computers
It is April 2019. Microsoft sees a Russian actor making contact with devices at customers. Not with servers. With a printer, a VoIP phone and a video decoder. On two of them the factory password had never been changed; the third had long gone unpatched. From there the actor moved on through the corporate network. The attacks were attributed to Fancy Bear: GRU unit 26165.
A year earlier that same unit had sent intelligence officers to The Hague for a close-access operation. Now it came in through office equipment. If the factory password is enough, an advanced actor will take the simple way in as well. That pattern keeps coming back.
In January 2024 the FBI dismantled a botnet, built out of thousands of home routers, that the unit used as an espionage platform. A small detail: the GRU had not even been the first to hack those routers. Criminals had installed a botnet using publicly known default passwords. The GRU hijacked the botnet and turned it into infrastructure of its own.
In May 2025 the NSA and the MIVD warned about Unit 26165 again. The unit was seeking access to IP cameras at border crossings, rail locations and military installations in order to track transports heading for Ukraine. The analysis surfaced more than 10,000 cameras. The Netherlands was a target too. The GRU does not need to place a camera if one is hanging there already.
This past July the NSA, with partner services, warned about this pattern once more, but now on the part of the Russian FSB. Vulnerable and poorly configured network equipment forms a route into critical networks in the defence industry. The recommendations are fairly banal: strong passwords, secure configuration and current firmware. What do all these campaigns have in common? They are computers that nobody treats as computers.
Look at your own environment through that lens, certainly in the places where sensitive information is discussed or processed. A video bar. A meeting room display. The booking panel beside the door. A camera. A printer. What has a microphone, a camera, an occupancy sensor, a network connection or any other sensor? Who patches it? Who sees anomalous traffic? Who manages the credentials? If it stays quiet, you have found your own path of least resistance.
The answer “the supplier” no longer suffices. The Dutch Cybersecurity Act makes supply chain security part of your duty of care. Organisations have to manage supply chain risks and set security requirements for suppliers; management must oversee implementation.
A device without an administrator does not exist. A device whose administrator nobody can name does.
Sources
- CERT-EU. “Corporate IoT – an intrusion path for APT groups.” Threat memo 190905-1, 5 September 2019. Source for the three devices (VoIP phone, printer, video decoder), for the unchanged factory passwords and the missing security update, for the lateral movement through the network in search of higher-privileged accounts, and for the attribution to APT28, also known as Fancy Bear and Strontium. The memo draws on the Microsoft Security Response Center publication, which dates the observation to April 2019.
- Netherlands Ministry of Defence. “Russian cyber operation.” 4 October 2018. Source for the close-access operation by Unit 26165 in The Hague, a year before the Microsoft observation.
- U.S. Department of Justice. “Justice Department Conducts Court-Authorized Disruption of Botnet Controlled by the Russian Federation’s Main Intelligence Directorate of the General Staff (GRU).” 15 February 2024. Source for the January 2024 operation, for Unit 26165, and for the fact that it was criminals rather than the GRU who installed the Moobot malware on Ubiquiti EdgeOS routers still using publicly known default passwords, after which the GRU took the botnet over.
- NSA, MIVD and others. “Russian GRU Targeting Western Logistics Entities and Technology Companies” (AA25-141A). 21 May 2025. Source for the renewed warning about Unit 26165, for the sample of more than 10,000 cameras at border crossings, military installations and rail locations, and for the Netherlands as one of the countries with targeted entities. The MIVD is a co-sealer.
- NSA and others. “Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting” (AA26-194A). 13 July 2026. Source for the warning about FSB Center 16, for poorly configured network equipment as a route into the defence industrial base among others, and for the recommendations on configuration and firmware.
- NCSC. Infosheet on the duty of care under the Dutch Cybersecurity Act (Dutch). Source for supply chain security as part of the duty of care (article 21(2)(d) Cbw) and for the management body approving the measures and overseeing their implementation. Worked out in ABRO and the Cybersecurity Act.
The CERT-EU memo attributes the campaign to APT28 and does not use the designation GRU Unit 26165; that follows from the later publications below. Figures for the number of routers differ. The Department of Justice press release describes a network of hundreds of SOHO routers; in the same release the FBI Boston field office refers to over a thousand routers remediated worldwide.
Read more about our electronic security surveys and TSCM sweeps.