The weak link in modern warfare: Russia's FSB quietly walking through the world's routers- 293

July 16, 2026

The US and a coalition of allied governments have issued a joint warning that a cluster of Russian intelligence-linked hacking groups is systematically breaking into poorly secured network routers and other networking devices around the world, using the access gained to reach into the critical infrastructure — communications, energy, defense, finance, government, and healthcare systems — that sits behind those devices. The advisory attributes the activity to Russia's FSB Center 16, the same unit whose operators are already known publicly under several names: Berserk Bear, Energetic Bear, Ghost Blizzard, Crouching Yeti, Dragonfly, and Static Tundra.

The method described is notably unsophisticated in its opening move, which is itself the point: rather than deploying a novel exploit, the group scans the open internet for routers that still expose an old network-management protocol called SNMP with weak or default authentication — essentially routers left with a manufacturer's factory password never changed by whoever installed them. Once found, the attackers send forged requests to the device that trick it into handing over its full configuration file, which they then quietly copy off to their own servers using basic file-transfer protocols. Beyond this SNMP-scanning approach, the same actors also occasionally exploit known, previously disclosed software flaws in Cisco equipment specifically — including a vulnerability from 2018 (CVE-2018-0171) and one dating back even further, to 2008 (CVE-2008-4128) — along with Cisco's Smart Install feature and web-based device management portals, showing the group is willing to reach for older, unpatched weaknesses just as readily as opportunistic scanning.

One detail worth flagging for anyone tracking cross-actor tradecraft: the advisory notes this same technique set overlaps with methods used by Salt Typhoon, a threat actor publicly associated with China, and more broadly with other nation-state groups beyond Russia. That overlap doesn't imply coordination between Moscow and Beijing — it more likely reflects the fact that badly configured routers represent such a widespread, low-effort opportunity that multiple states' intelligence services have independently converged on the same entry point, since the underlying weakness (old protocols, unchanged passwords, unpatched firmware) is a structural problem in how organizations manage network hardware rather than a Russia-specific one.

The advisory's core message to network defenders is correspondingly unglamorous but concrete: disable Cisco's Smart Install feature entirely if it isn't needed, retire the older, weakly-authenticated versions of SNMP (v1 and v2) in favor of SNMPv3 with strong encryption, and enforce unique, securely stored passwords on every device rather than shared or default ones. Beyond that, organizations are urged to actively monitor SNMP traffic for unusual activity, restrict who can reach device-management interfaces using access control lists, block outside access to unnecessary ports tied to file transfer and device management (TFTP, Cisco's Smart Install port, and SNMP itself), watch for unexplained configuration changes, keep firmware current, retire equipment that's no longer supported by its manufacturer, and use attack-surface management tools to find exposed devices before an adversary does.

The broader point the advisory makes, even in its brevity, is a strategic one: a state intelligence service doesn't need sophisticated malware to compromise critical infrastructure if the network hardware sitting at its perimeter was never properly secured in the first place — and the same neglected router config that lets FSB Center 16 in is just as inviting to any other state actor running the same simple scan.