Russian GRU hackers conducted a years-long campaign starting in 2021 targeting Western critical infrastructure, especially the energy sector. Initially exploited vulnerabilities in WatchGuard, Confluence, and Veeam, but evolved to focus on misconfigured customer network edge devices including enterprise routers, VPN gateways, network management appliances, collaboration platforms, and cloud-based project management solutions. Used passive packet capturing and traffic interception for credential theft. Targeted customer-managed network appliances hosted on AWS EC2 instances. Campaign involved post-compromise lateral movement and credential harvesting.