TORONTO/KIEV: Cisco Systems Inc. warned on Wednesday that hackers have infected at least 500,000 routers and storage devices in dozens of countries with sophisticated malicious software — activity Ukraine said was preparation for a future Russian cyberattack.
Cisco’s Talos cyber intelligence unit has high confidence that the Russian government is behind the campaign, according to Cisco researcher Craig Williams, because the hacking software shares code with malware used in previous cyberattacks that the US government has attributed to Moscow.
Ukraine’s SBU state security service said the activity showed Russia was readying a large-scale cyberattack against Ukraine ahead of the Champions League soccer final, due to be held in Kiev on Saturday.
“Security Service experts believe the infection of hardware on the territory of Ukraine is preparation for another act of cyber-aggression by the Russian Federation aimed at destabilising the situation during the Champions League final,” it said in a statement after Cisco’s findings were released.
Russia has previously denied assertions by Ukraine, the United States, other nations and Western cyber-security firms that it is behind a massive global hacking program, which has included attempts to harm Ukraine’s economy and interfering in the 2016 US presidential election.
The Kremlin did not immediately respond to a request for comment submitted by Reuters on Wednesday.
Cisco said the new malware, dubbed VPNFilter, could be used for espionage, to interfere with Internet communications or launch destructive attacks on Ukraine, which has previously blamed Russia for massive hacks that took out parts of its energy grid and shuttered factories.
“With a network like this you could do anything,” Williams told Reuters.
CONSTITUTION DAY ATTACK
The warning about the malware — which includes a module that targets industrial networks like ones that operate the electric grid — will be amplified by alerts from members of the Cyber Threat Alliance (CTA), a nonprofit group that promotes the fast exchange of data on new threats between rivals in the cybersecurity industry.
Members include Cisco, Check Point Software Technologies Ltd. , Fortinet Inc. Palo Alto Networks Inc, Sophos Group Plc and Symantec Corp.
“We should be taking this pretty seriously,” CTA Chief Executive Officer Michael Daniel said in an interview.
The devices infected with VPNFilter are scattered across at least 54 countries, but Cisco determined the hackers are targeting Ukraine following a surge in infections in that country on May 8, Williams told Reuters.
Researchers decided to go public with what they know about the campaign because they feared the surge in Ukraine, which has the largest number of infections, meant Moscow is poised to launch an attack there next month, possibly around the time the country celebrates Constitution Day on June 28, Williams said.
Some of the biggest cyberattacks on Ukraine have been launched on holidays or the days leading up to them.
They include the June 2017 “NotPetya” attack that disabled computer systems in Ukraine before spreading around the globe, as well as hacks on the nation’s power grid in 2015 and 2016 that hit shortly before Christmas.
VPNFilter gives hackers remote access to infected machines, which they can use for spying, launching attacks on other computers or downloading additional types of malware, Williams said.
The researchers discovered one malware module that targets industrial computers, such as ones used in electric grids, other infrastructure and in factories. It infects and monitors network traffic, looking for login credentials that a hacker can use to seize control of industrial processes, Williams said.
The malware also includes an auto-destruct feature that hackers can use to delete the malware and other software on infected devices, making them inoperable, he said.
Cyber firms, Ukraine warn of planned Russian attack
Cyber firms, Ukraine warn of planned Russian attack
- Cisco warns 500,000 routers have been hacked in suspected Russian plan to attack Ukraine
- The hacking software shares code with malware used in previous cyber attacks that the U.S. government has attributed to Moscow
Islamist militants show ‘unprecedented coordination’ in Burkina Faso attacks
- The assaults were on several towns in the north and east including Bilanga, Titao, Tandjari and Nare
- The operations targeted military detachments, civilian convoys and market areas
DAKAR: Islamist militants have killed dozens of soldiers and civilians and overrun an army detachment over the past week in coordinated attacks across multiple regions of Burkina Faso, according to internal reports by two diplomatic missions reviewed by Reuters.
The operations by Al Qaeda–linked Jama’at Nusrat Al-Islam wal-Muslimin show the JNIM is increasingly able to mobilize across large swathes of territory at one time, said the reports, which described a list of locations and places that came under assault.
Burkina Faso’s military rulers seized power in a coup in 2022, promising to improve security. But militants’ attacks have increased in the West African country as state forces battle an insurgency that has spread across the Sahel from Mali.
The assaults were on several towns in the north and east including Bilanga, Titao, Tandjari and Nare, the diplomatic reports said. One also described an assault in the eastern city of Fada N’Gourma and flagged another in the northern Ouahigouya area.
“These attacks, which were almost simultaneous and spread across several provinces, demonstrate unprecedented coordination between militants and the junta’s inability to contain the assaults,” said one of the internal reports, which put the death toll at more than 180.
The other gave no toll but said the incidents appeared coordinated and involved several hundred militants serving JNIM and possibly Daesh affiliates.
The operations targeted military detachments, civilian convoys and market areas, it said.
JNIM has said it killed scores of troops from the Burkinabe army in attacks in the past week, US-based SITE Intelligence Group said on Monday.
Burkina authorities did not respond to a request for comment on the assaults or casualty reports.
INJURED GHANAIANS RETURN HOME
In the northern town of Titao, militants attacked an army base and set a market on fire, the internal reports said.
Nearly 80 soldiers and pro-government militia members were killed, one said. The other said about 10 civilians were killed there.
The dead civilians included eight tomato traders, Ghana’s foreign ministry said on Tuesday.
SITE quoted a media unit for JNIM as saying the insurgents had seized military vehicles, guns and other possessions in the assaults. More than a decade of insurgencies in the Sahel has displaced millions and engendered economic collapse, with violence pushing further south toward West Africa’s coast.
JNIM claimed nearly 500 attacks in Burkina Faso in 2025 and nearly 300 in Mali, SITE’s director, Rita Katz, said in a social media post on LinkedIn.
