12 nations warn of Russian state hackers targeting routers globally
This digest was compiled by AI from multiple sources — links to the originals are below.
Cybersecurity agencies from 12 countries issued a joint advisory warning that Russian FSB Center 16 hackers are actively scanning for vulnerable routers worldwide using weak SNMP passwords. The advisory urges sectors including energy, defense, and healthcare to upgrade to SNMPv3 to prevent configuration theft.
The Threat Actor
The joint advisory identifies the threat actor as Russian FSB Center 16, also known as Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard, and Static Tundra. The group has been observed scanning the internet for routers using default or weak SNMP community strings. Once accessed, they use Object Identifiers to command routers to copy configurations and exfiltrate them via TFTP to attacker-controlled servers.
Sectors at Risk
The advisory warns that communications, defense, energy, financial services, government, and healthcare sectors are most at risk. The agencies recommend using SNMPv3, which provides authentication and encryption, unlike SNMPv1 and v2 that transmit community strings in plaintext. The group has also exploited Cisco Smart Install vulnerability CVE-2018-0171 in unpatched devices.
Coordinated Attribution
The advisory was co-authored by agencies from Australia, Canada, Czech Republic, Denmark, Estonia, Finland, France, Italy, New Zealand, Poland, Sweden, the UK, and the US. Separately, the UK and EU officially attributed the late-2025 cyber-attacks on Poland's energy grid to FSB Center 16. The UK government stated the attack could have cut power to 500,000 citizens in winter.
What's Next
Organizations are urged to immediately upgrade to SNMPv3 and patch Cisco Smart Install vulnerabilities. It remains unclear how many routers have been compromised globally or whether the group has shifted tactics following the public advisory.
1 source
12 nations warn of Russian state hackers targeting routers globally
