Dive Brief:

• Last Monday, Mandiant said it had found 14 Cisco routers in four countries infected with rogue firmware, CIO reports.
• But after a closer look, the Shadowserver Foundation found the malicious firmware installed on nearly 200 routers used by businesses from over 30 countries – many more than was originally reported.
• The firmware provides attackers with backdoor access and the ability to install custom malware modules.

Dive Insight:

Since the find by Mandiant last week, the Shadowserver Foundation has been running a scan with Cisco's help to identify more potentially compromised devices. A total of 199 devices in 31 countries have now been found that show signs of compromise.

Attackers can control these compromised routers that sniff and modify network traffic, redirect users, and launch a variety of other attacks against local network devices.

"It is important to stress the severity of this malicious activity," the Shadowserver Foundation said. "Compromised routers should be identified and remediated as a top priority."

Cisco had issued an advisory about the issue in August, CIO reports. The affected models are no longer sold by the company. Those affected should replace Cisco firmware on integrated services routers.