Your Router, Their Bridge

The GRU has a much richer relationship with your router than you do.

This week the U.S. government — CISA, the FBI, and a chorus of allied agencies — issued yet another advisory confirming what the incident reports have been saying for years: Russian state hackers are living inside residential and small-office routers, and they've been doing it for a long time. The FBI's own accounting has one unit, GRU Military Unit 26165 — the crew variously branded APT28, Fancy Bear, Forest Blizzard, Sofacy, Pawn Storm — spending at least two years compromising home and small-office boxes across 23 U.S. states. Separately, the FSB's Center 16 is described as "opportunistically" hoovering up poorly configured devices worldwide, using them to worm toward critical infrastructure.

Note the word nobody wants to sit with: bridge. Some of this is ordinary spying — the FBI's advisory is filed under stealing sensitive information, Malwarebytes leads with surveillance of users, and yes, an intruder on your router will happily read what crosses your wire. But the part the reporting keeps circling, the part no advisory ever warned you to expect, is what your router lets them become: an anonymous relay, a piece of ordinary American residential IP space they can route through so the next attack looks like it came from a house in Ohio instead of a building in Moscow. They want the data and they want the bridge — and the bridge is the one you never imagined you were handing over. Your privacy isn't just breached here. It's conscripted. Your network is drafted as cover for the operation against someone else.

This is the part the announcement gets right and then immediately makes weird. The recommended mitigations are technically flawless and socially fictional: update your firmware, disable outdated SNMP, use a strong password, turn off the services you're not using. Sound advice. Now go find one non-technical human being who has installed a router firmware update this decade. The security model quietly assumes a diligent administrator standing behind every home network. What actually stands there is a box the ISP shipped you, running software the manufacturer stopped patching two product cycles ago, humming along in a closet until it dies. "No updates available," it says, and it is telling the truth, because the vendor moved on.

Here's the coherenceism read, and it's not comforting. You never owned this layer. You rented the sense of ownership. The router was sold to you as your home network — a private, bounded, domestic thing, yours the way the walls are yours. But it was always a node in a graph you don't control, running firmware you can't read, reachable from an internet that doesn't recognize the concept of "home." The advisory didn't create that exposure. It just described a boundary you assumed existed and never did.

And the exposure isn't a bug anyone forgot to fix — it's an equilibrium nobody has a reason to disturb. The ISP ships the cheapest box that boots. The manufacturer abandons the firmware after two product cycles, because patching a device it already sold generates no revenue. And the obligation to keep the thing secure lands on the one party structurally incapable of meeting it: you, in the closet, with the 2003-era web panel and the green light. Insecurity here isn't the system failing. It's the system at rest — every incentive pointing exactly where the router already is: unpatched, forgotten, and perfect for bridging. This is what it looks like when a maintenance responsibility gets passed hand to hand until it lands on whoever was least able to refuse it, and then goes quiet. Distortion travels most freely through exactly the infrastructure we've all agreed to stop looking at — and we picked the router precisely because it was boring.

So the government will keep issuing advisories, and the advisories will keep saying update your firmware, and the firmware will keep not existing, and Unit 26165 will keep bridging. The green light will stay green. That was always the problem — not a broken system but a working one, doing exactly what its incentives ask of it. The router was built to give you a single signal, and the signal is green, and green is the color of a responsibility that got handed around until it landed on you and stopped moving.