Threat group is installing a backdoor in compromised Cisco router firmware. NSA says get better kit
"The modified firmware uses a built-in SSH backdoor, allowing BlackTech actors to maintain access to the compromised router without their connections being logged"