Cybersecurity agencies from the United States and eight other countries have issued a joint warning that Russian state hackers are targeting vulnerable and poorly configured routers to infiltrate critical infrastructure networks.

The joint advisory, co-authored by the NSA, FBI, and CISA, along with 15 other agencies from Australia, the United Kingdom, Canada, New Zealand, Estonia, Finland, France, and Italy, attributes the attacks to hackers from the Russian Federal Security Service (FSB) Center 16.

This hacking group (tracked as Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard, and Static Tundra) scans internet-connected IP address ranges for routers accepting default or common SNMP authentication strings, then issues commands using spoofed IP addresses to copy device configuration files and exfiltrate them via the Trivial File Transfer Protocol to actor-controlled servers.

In August 2025, the FBI also warned that the same group has been targeting critical infrastructure using a critical vulnerability in the Smart Install feature of Cisco IOS and Cisco IOS XE software (tracked as CVE-2018-0171) since November 2021.

The sectors most at risk from these attacks include energy, communications, defense industrial base, healthcare, financial services, defense, and state and local government services.

“Centre 16 [..] has been seen hunting for vulnerable routers by scanning the internet for devices that still use default or weak Simple Network Management Protocol (SNMP) passwords and community strings,” the UK National Cyber Security Centre warned on Monday.

“Whilst the actor primarily uses SNMP scans to locate and compromise vulnerable routers, they have also exploited well-known vulnerabilities relating to Cisco devices, Cisco’s Smart Install (SMI) feature and web-portal flaws to gain control of network devices.”

The authoring cybersecurity also provided mitigation measures to help network defenders harden their networks against these attacks, urging them to upgrade to SNMPv3, disable Cisco Smart Install, enforce strong unique passwords, block TFTP and SNMP traffic at edge firewalls, update software and firmware, and replace end-of-life devices.

​This advisory follows an international law enforcement operation that disrupted FrostArmada, a separate campaign attributed to APT28 (a Russian military intelligence group linked to GRU unit 26165, also tracked as Fancy Bear and Forest Blizzard) that had infected 18,000 routers across 120 countries by December 2025.

Hackers altered DNS settings on compromised MikroTik and TP-Link small office/home office (SOHO) routers to redirect authentication traffic to attacker-controlled servers and steal Microsoft 365 logins and OAuth tokens.

As part of a court-authorized operation, with support from the U.S. Department of Justice, the Polish government, and multiple cybersecurity companies, the FBI remotely removed malicious DNS settings to secure the compromised routers and forced them to connect to legitimate DNS resolvers.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

The European Union and the United Kingdom jointly sanctioned dozens of Russian individuals and entities and accused Russia of coordinating a network of hacking groups responsible for attacks across Europe.

Today, the Council of the European Union announced sanctions on nine individuals and four entities, including Russian military intelligence (GRU) officers and cybercriminals, while the UK separately sanctioned 24 individuals and entities, including senior GRU figures Vyacheslav Stafeyev, Ivan Senin, and Ivan Kasyanenko, whom officials say directed cyber and hybrid operations.

Britain also sanctioned members of the IMPULS company, accused of recruiting hackers from Russian universities, as well as individuals tied to the Lumma Stealer malware operation, which UK authorities linked to at least 2,100 domestic victims over six months. Ten people connected to media outlet Rybar LLC were also designated for spreading anti-Ukraine narratives and alleged election interference in Moldova and Armenia.

The Council of the EU also publicly identified the 16th Centre of Russia’s Federal Security Service (FSB) as controlling several cyber threat groups, including the notorious Turla hacking group.

Officials said the unit has spent years targeting government networks and critical infrastructure in France, Germany, Poland, Cyprus, the Netherlands, Austria, Slovakia, Romania, and Finland, running cyberespionage campaigns against government and defense targets since 2010.

Turla hackers were also linked to a recent failed strike targeting Poland’s critical infrastructure, including energy grid organizations such as heat and power plants, which could have cut power to roughly 500,000 people during winter.

“Cybercriminals, self-proclaimed hacktivists and private companies linked to Russia, including actors operating under its instructions, direction or control, have also carried out, enabled and facilitated a wide range of malicious activities. We strongly condemn Russia’s behaviour and misuse of this cyber ecosystem, targeting public services and critical infrastructure, causing disruptions and financial losses,” the Council of the EU said.

“In response to malicious activities, the EU is also imposing restrictive measures on nine individuals and four entities. These EU sanctions include GRU intelligence officers, as well as cybercriminals, self-proclaimed hacktivists and private companies that contribute to Russia’s efforts to destabilise the EU, its member states and international partners.”

As BleepingComputer previously reported, a cyberattack in late December that hit dozens of entities in Poland’s power grid damaged key operational technology (OT) equipment beyond repair but failed to disrupt power. The incident was later attributed to the Russian state-backed hacking group Sandworm, which attempted to deploy the destructive DynoWiper data-wiping malware and disable compromised devices.

More recently, Poland also blocked a cyberattack targeting the IT infrastructure of the National Centre for Nuclear Research (NCBJ), the country’s main government nuclear research institute specializing in nuclear physics, reactor technology, and particle physics.

Today’s sanctions come on the heels of the European Commission’s January proposal for new cybersecurity legislation designed to strengthen defenses against cybercrime and state-backed threat groups targeting European critical infrastructure.

In March, the Council of the European Union also sanctioned three Chinese and Iranian companies for coordinating cyberattacks targeting EU member states’ critical infrastructure.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Advertisement

Get the whitepaper

Losing an important file by mistake can be frustrating, especially if you’ve already emptied the Recycle Bin or deleted it using Shift + Delete. While it may seem like the file is gone forever, that’s not always the case. Deleted files often remain on the drive until new data overwrites them, giving you a chance to recover them. That’s why it’s important to stop using the affected drive as soon as possible. In this article, we’ll cover the best free ways to permanently recover deleted files and share important tips to avoid making the situation worse.

What Happens When a File Is Permanently Deleted?

Normal deletion and permanent deletion operate differently. A normal deletion means the file goes to the Recycle Bin, where it can be recovered later. Permanent deletion means the file will be deleted immediately or after the Recycle Bin is cleared. This can occur when deleting files on the USB drive or the SD card, or when deleting large files that cannot fit in the Recycle Bin. Until new files overwrite that space, the deleted file may still be recoverable.

Before proceeding with recovering your deleted files, ensure you stop using the drive containing them. Avoid copying, saving, installing, or downloading any data to this drive, as additional data could overwrite your deleted files. It is also a good idea to verify whether your file exists within your backup system or in your online storage. If your files have been deleted from a USB drive, an SD card, or an external hard drive, then do not use the drive anymore. Remember that SSDs use the TRIM feature, which can make file recovery more difficult if you wait too long.

Different Free Ways to Recover Permanently Deleted Files

1. Check the Recycle Bin

If you have deleted the files using the Recycle Bin or Shift + Delete, you can proceed directly to the next recovery steps. This approach will only work if the file is still in the Recycle Bin.

• Open the Recycle Bin.
• Search for the deleted file by name or file type.
• Right-click on the file and choose ‘Restore.’
• The file will be restored to its original place.

2. Restore from File History

Another way to recover deleted files is File History. It is a Windows feature that provides backup copies of your files. If it was enabled, you may be able to recover a previous version of your deleted file.

• Search for “Restore your files with File History” on Windows.
• Open the recovery window.
• Browse the available file versions.
  
• Select the file or folder you want to recover.
• Click Restore to save it back to its original location.

3. Check Cloud Storage

Deleted files may remain in cloud storage for some time before being permanently deleted. If you previously uploaded the file to a cloud storage service, you may be able to restore it.

• Log in to your OneDrive, Google Drive, Dropbox, or another cloud account.
• Browse to the folder where the file was saved.
• Open the Trash or Deleted Files folder.
• Restore the file to its original location or download a copy.
  

4. Restore from a Backup

If you have a backup of your files, recovering them is usually quick and easy. Check your external hard drive, USB backup, or any manually created backup folders for the missing file.

Recover Permanently Deleted Files for Free Using Stellar Data Recovery Free Edition

When manual recovery methods fail, you can try Stellar Data Recovery Free Edition. This software will help retrieve deleted files from a Windows PC, a USB drive, an SD card, or other external media. The program allows scanning the disk, browsing, and restoring the retrieved files. In the Free Edition, there is up to 2GB of free data retrieval, including 1GB by default and an additional 1 GB through social networking.

Follow these steps to recover permanently deleted files using Stellar Data Recovery Free Edition.

1. Download and install Stellar Data Recovery Free Edition.
2. Launch the software.
3. Choose the type of files to recover or select Recover Everything.
   
4. Select the drive where the files were deleted.
5. Run a scan and use Deep Scan if needed.
   
6. Preview recoverable files.
7. Recover the selected files.
   
8. Save recovered files to a different drive.
9. If you need more recovery space, you can unlock an extra 1GB for free.

Steps to Get Your 2 GB Free Data Recovery

You can increase the free recovery limit by following these steps.

1. Click Get it Now in the activation window.
2. Select Upgrade Later to continue with the 1GB free version.
3. When you reach the limit, click the option to unlock an additional 1GB.
4. Share your experience on social media.
5. Enter the review link, your name, and your email address.
6. Submit the form to activate the 1GB bonus using the key sent to your email.

When Should You Use Deep Scan?

Most recovery tools start with a Quick Scan because it is faster. However, it may not find every deleted file. If the Quick Scan doesn’t show your file, try Deep Scan instead. It is also useful if the drive was formatted, the storage device became inaccessible, or the file was deleted a long time ago. Deep Scan takes longer to complete but may find additional recoverable files.

You can recover many different files that were deleted, depending on the storage device’s status. It can be documents, pictures, videos, emails, and ZIP files. The types of document files that can be recovered include Word, Excel, PDF, and PowerPoint files. At the same time, among the types of picture files that can be recovered are JPG, PNG, HEIC, and RAW. File recovery software is also compatible with Windows PCs/Laptops, SSDs, hard disks, USB drives/ SD cards.

Things to Keep in Mind

File recovery is not always successful, so it’s important to keep your expectations realistic. Once your files have been overwritten with new data, there is no way to recover them successfully. Another problem that might affect the success of file recovery is the TRIM functionality in SSDs. With the Stellar Data Recovery Free Edition, one can restore up to 2GB of data free of charge. If one needs to recover data larger than 2GB, they will have to purchase the software.

Tips to Improve Your Recovery Chances

The actions you perform after deletion could affect the ability to recover your files. It is important not to use the drive containing the deleted files, as you may overwrite them with fresh data. If possible, try installing the software on another drive. This helps avoid writing new data to the same storage location.

Always make sure to transfer the recovered files to another drive, not back to the original one. If your files are not found during a Quick Scan, a Deep Scan is available. Preview your recoverable files before recovery to ensure they are the right ones. Complete the file recovery process immediately and keep regular backups to reduce the risk of future data loss.

Final Verdict

Recovering permanently deleted files depends on how the files were deleted and whether the data has been overwritten. For instance, restoring files from the Recycle Bin or a backup is the preferred method when they are available. Whereas, when the files are deleted by pressing “Shift” and “Delete”, deleted from the Recycle Bin, or deleted from an external hard drive, then the use of Stellar Data Recovery Free Edition will be useful. It lets you scan your storage device, preview recoverable files, and recover up to 2 GB of data for free, with the option to upgrade to a paid edition if needed. For users who need to recover more than the free limit, Stellar offers paid plans starting at around $49. The paid plans are worth considering if you need to recover more than the free limit. However, the Stellar Data Recovery Free Edition is one of the best options to recover files.

Apple filed a lawsuit Friday against OpenAI over allegations of trade secret theft and breach of contract.

The iPhone maker alleges that this misconduct, which it says reveals a pattern of theft from OpenAI employees who previously worked at Apple, was directed by OpenAI’s senior leadership, including Chief Hardware Officer Tang Tan.

The lawsuit, which was filed in the U.S. District Court for the Northern District of California, accuses Tan of using Apple’s confidential project code names during OpenAI’s recruiting process, asking job candidates to bring in Apple hardware components to their interviews, coaching departing Apple employees on how to evade the company’s security procedures, and asking for details about the company’s unannounced products.

Before joining OpenAI, Tan had spent 24 years at Apple, most recently as VP of product design for the iPhone and Apple Watch.

The accusations come at a time when OpenAI is rumored to be developing its first hardware product, which would likely compete with the iPhone. In April, industry analyst Ming-Chi Kuo suggested this device could be a smartphone that would rely on AI agents instead of apps. If true, it would be one of the largest threats to Apple’s core hardware business to date.

Apple’s former lead designer Jony Ive’s device startup io was acquired by OpenAI last year in a $6.5 billion deal to aid the AI company with its hardware ambitions. While io was named in the filing, Ive was not.

Tan is not the only OpenAI employee referenced in the new complaint. Apple also alleges that Chang Liu, who spent eight years at Apple as a senior systems electrical engineer, failed to return an Apple-issued laptop after leaving the company for OpenAI in 2026 and had used the computer to download confidential Apple technical documents.

Apple says in the complaint that the stolen documents included information about unannounced technologies, features, and products, including technical specifications, engineering presentations, and proprietary project data.

Liu is also accused in the lawsuit of sharing Apple’s confidential information with other Apple employees applying for jobs at OpenAI, advising at least one of them on what to study before their interview.

Apple sent a letter to OpenAI in February to raise its concerns and received no response, the company said in the complaint.

It alleges that the behavior of these former employees is part of OpenAI’s strategy to extract Apple’s confidential information, which included asking Apple employees to bring designs and prototypes to their interviews, and answer questions about things like component and vendor selection processes.

Apple says its ongoing investigation revealed that OpenAI and its partners have even used Apple’s confidential information while the AI model maker develops its own hardware product. For instance, the filing references a proprietary metal finishing technique that OpenAI used after it allegedly misled a partner into believing it had Apple’s permission to do so.

Like many tech companies, Apple typically investigates potential trade secret theft or other improper activity by analyzing communications that took place on company-owned devices and reading through its server logs. By taking the case to court, Apple will have an opportunity to learn more about the extent of the alleged operation through the legal discovery process.

Apple is asking the court to bar OpenAI from using or disclosing its trade secrets, require the company to return any confidential Apple materials, and preserve evidence related to the case.

“This is the tip of the iceberg. Apple lacks visibility into what’s been happening behind closed doors at OpenAI, where such misconduct is normalized and exemplified by leadership,” the filing states. “As a natural result, OpenAI’s nascent hardware business now rests on the shakiest of foundations, rotten to its core by its illegal reliance on misappropriated trade secrets.”

In a prepared statement, Apple also said the following:

At Apple, our teams are constantly developing breakthrough technologies to create the best products and services in the world, and protecting their work and intellectual property is something we take very seriously. Recently, significant evidence has emerged suggesting individuals employed by OpenAI wrongfully took Apple’s secret and confidential information regarding our unreleased technologies, processes, and products. We will always defend our teams’ hard work and innovations, and we are taking all appropriate steps to do so.

OpenAI was asked for comment. The company responded after publication, pointing to its public statement shared on X, which reads: “We have no interest in other companies’ trade secrets. We remain focused on building innovative technology that empowers people everywhere.”

The filing is available here, or you can read it below.

This story is developing and will be updated. It was originally published at 1:32 p.m. PT.