FBI, DHS, and UK's National Cyber Security Centre issue joint alert warning of a Russian-led global campaign to attack and infiltrate internet infrastructure
State-sponsored Russian hackers are actively seeking to hijack essential internet hardware, US and UK intelligence agencies say.
Context & Ripple Effects
The 2018 FBI–DHS–NCSC alert is the template-setting moment in a pattern the related coverage keeps repeating: allied intelligence agencies going public together to name state-backed hacking campaigns. The same playbook reappears when [[a:978147|Five Eyes cybersecurity authorities warned of Russia-backed groups targeting critical infrastructure]] in 2022, and again when the FBI and MI5 issued their rare joint statement to tech companies over Chinese IP theft that July.
What makes this alert distinct is its target layer — not election systems or energy networks but the routers and switches underneath everything, the same class of infrastructure later at stake when US and UK agencies accused Russia's FSB of a global campaign reaching energy networks in the 2023 FSB attribution, and when a Chinese telecoms intrusion was reported as having expanded to 80 countries by the 2025 FBI-led warning.
First-order effects
- Network operators running internet backbone and enterprise routing hardware are told to hunt for compromise now, with FBI, DHS, and the NCSC effectively deputizing thousands of private admins as the front line.
- Vendors of core internet equipment come under immediate scrutiny from three governments at once, since hijacked hardware is the stated objective rather than stolen data.
Second-order effects
- The joint-alert format hardens into standard practice: within four years it scales from three agencies to the full Five Eyes grouping warning on critical infrastructure, making coordinated attribution the default response rather than a bilateral exception.
- Infrastructure operators begin treating government advisories as procurement and patching inputs, shifting security spending toward the hardware and firmware layer the alerts repeatedly name.
Third-order effects
- If the cadence holds — Russia campaigns in 2018 and 2023, China campaigns in 2022 and 2025 — public attribution becomes a standing instrument of alliance policy, with internet infrastructure permanently reframed as contested geopolitical terrain rather than neutral plumbing.
- Repeated state-level intrusions into shared networking gear push governments toward treating the network substrate itself as sovereign-critical, accelerating the structural split of what was once a globally common infrastructure.
The trend: Western intelligence agencies have normalized joint public advisories against state hackers, steadily converting internet infrastructure security from a technical concern into formalized alliance policy.