Every time data moves across the internet, it follows a path determined by a protocol almost no one thinks about — the Border Gateway Protocol. BGP is the backbone of global routing, and it was built on trust rather than verification. This episode of Cybersecurity explores what happens when that trust gets exploited, drawing on this deep-dive on BGP hijacking and how routing gets weaponized to unpack one of the internet's most quietly dangerous attack surfaces.

Here's what the episode covers:

• How BGP actually works: Internet service providers use BGP to announce which IP address blocks they're responsible for — and because routers are designed to trust those announcements, a false claim can redirect massive amounts of traffic with no immediate alarm.
• Accidental vs. intentional hijacks: Many routing incidents are genuine misconfiguration errors, but state-sponsored actors and criminal organizations have deliberately weaponized BGP for espionage and financial fraud — and the "probably just a mistake" assumption provides dangerous cover.
• Why no organization is too small to be a target: High-profile hijacks make headlines, but smaller networks carrying personal data, financial transactions, or operational traffic are equally viable targets.
• The stealth factor: The most dangerous BGP hijacks are the silent ones — man-in-the-middle rerouting attacks designed to intercept and pass along traffic without triggering any outage, sometimes going undetected for weeks.
• RPKI and route filtering as the core technical defenses: Resource Public Key Infrastructure lets operators cryptographically sign their route announcements, giving routers a way to verify legitimacy. Combined with disciplined route filtering and real-time attack surface monitoring, these layers significantly reduce hijack risk.
• The right questions to ask your provider: Whether you manage your own network or rely on an ISP or managed security partner, knowing what to ask about RPKI adoption, route filtering, and anomaly detection is a practical starting point.

The broader takeaway is one that applies well beyond BGP: protocols built on implicit trust — without cryptographic verification — will eventually be abused. Understanding the mechanics of how an attack works, not just that it exists, is what separates reactive security from a genuinely defensible posture. Organizations looking to move in that direction can explore incident response capabilities designed to catch and contain threats before they escalate into major damage.

For more on threats hiding in the infrastructure layer, check out the episode Bare-Metal Backdoors: Detecting Persistent Firmware-Level Implants. Additional reading is available on the RMA blog.

RMA.ai