Twice this week, traffic to 200+ of the world's largest CDNs and cloud hosts was redirected through Russia's telco Rostelecom in likely BGP hijacking attacks
Rostelecom involved in BGP hijacking incident this week impacting more than 200 CDNs and cloud providers.
Context & Ripple Effects
This is the second time in two years a major national carrier has sat astride other networks' traffic: in 2019, European mobile traffic was rerouted through China Telecom after a BGP leak at a Swiss colocation firm that had made a similar mistake a year earlier. The pattern now involves Rostelecom, a carrier that has previously played both roles in routing incidents — it announced it sinkholed part of the Meris DDoS botnet in 2021, giving it operational experience manipulating global route announcements.
First-order effects
- More than 200 of the world's largest CDNs and cloud hosting providers had their traffic redirected through Rostelecom twice this week, exposing customer sessions to interception or manipulation while the bad routes propagated.
- Each incident forces the affected providers to detect and withdraw the hijacked prefixes, absorbing monitoring and mitigation work they did not plan for.
Second-order effects
- CDN and cloud operators now have a competitive reason to advertise stronger route-validation and hijack-detection guarantees, since customers choosing between hosts can treat routing integrity as a differentiator.
- The UK's finding that Russia-linked APT28 is hijacking consumer routers from MikroTik, TP-Link and others to steal credentials and redirect traffic shows the same objective pursued at the edge, pressuring both router vendors and backbone operators to respond in parallel.
Third-order effects
- If national carriers repeatedly appear in hijack events, BGP's trust model — where a route announcement is accepted largely on say-so — becomes a geopolitical liability, pushing the industry toward cryptographically verifiable route origin as default infrastructure rather than an opt-in extra.
The trend: Border Gateway Protocol manipulation is hardening into a recurring instrument of state-linked network operations, with national carriers like Rostelecom and China Telecom recurring actors in the incidents.