Russian Intelligence Exploits Poorly Configured Routers, NCSC Warns
UK's NCSC and international partners issue alert on Russian state-backed actors targeting critical infrastructure via vulnerable routers.
The UK's National Cyber Security Centre (NCSC), alongside international allies, has issued a joint advisory warning critical sectors about persistent targeting by Russian state-backed cyber actors. These actors are actively exploiting poorly configured routers globally to gain unauthorized access to sensitive networks, posing a significant threat to national security and critical infrastructure.
The advisory highlights a concerning trend where threat actors are scanning the internet for internet-facing devices, particularly routers, that have been left with default credentials or unpatched vulnerabilities. Once access is gained, these actors can conduct reconnaissance, exfiltrate sensitive data, or use the compromised devices as pivot points to access more secure internal networks. The NCSC emphasizes that this activity is part of a broader pattern of Russian intelligence services seeking to gain strategic advantage through cyber means.
While the advisory does not name specific threat groups, it attributes the activity to Russian state-backed actors, indicating a coordinated and resourced campaign. The focus on routers is strategic, as these devices often sit at the perimeter of networks and can provide a gateway into otherwise well-defended systems. The ease with which these devices can be compromised underscores the importance of basic cyber hygiene, even for organizations with sophisticated security postures.
The NCSC urges organizations across critical sectors—including government, defense, energy, and finance—to take immediate steps to improve their defenses. Key recommendations include ensuring all internet-facing devices are securely configured, regularly patched, and monitored for suspicious activity. Organizations are also advised to disable unnecessary services and implement strong, unique passwords for all administrative interfaces.
This alert serves as a stark reminder that even seemingly minor misconfigurations can have severe consequences when exploited by determined adversaries. The global nature of the exploitation means that organizations worldwide are at risk, regardless of their geographic location. The advisory encourages a proactive approach to security, moving beyond reactive incident response to robust preventative measures.
In response to this threat, the NCSC is working with industry partners to share threat intelligence and best practices. The goal is to bolster the collective resilience of critical infrastructure against state-sponsored cyber espionage and disruption. The advisory also stresses the importance of incident reporting to the NCSC, enabling a more comprehensive understanding of the threat landscape and facilitating timely responses.
While specific technical details of the exploitation methods are not fully disclosed in the public advisory, the emphasis on poorly configured routers suggests a reliance on common vulnerabilities such as weak authentication, default credentials, and unpatched firmware. This highlights a persistent challenge in cybersecurity: the gap between the availability of security best practices and their consistent implementation across diverse organizations and device types.
The NCSC and its allies are committed to providing ongoing guidance and support to help organizations defend against these evolving threats. The advisory concludes with a call to action for all critical infrastructure operators to review and enhance their security controls to mitigate the risk posed by Russian intelligence targeting.
This joint advisory from multiple international cybersecurity agencies provides further details on Russian state-sponsored actors targeting critical infrastructure. It specifically names FSB Center 16 (also known as Berserk Bear, Dragonfly, and others) as the group responsible for exploiting vulnerable routers using weak SNMP credentials and known Cisco vulnerabilities. The advisory also outlines specific mitigation measures, including upgrading to SNMPv3, disabling Cisco Smart Install, and enforcing strong passwords.
This joint advisory from 12 countries, including the US, UK, and EU, provides further details on the Russian state-sponsored threat actors' methods, identifying them as FSB Center 16 (also known as Berserk Bear, Dragonfly, and Static Tundra). The advisory highlights the exploitation of weak SNMP credentials and community strings, and notes that the group has also previously exploited CVE-2018-0171 in Cisco devices. Furthermore, the advisory coincides with the official attribution by the UK and EU of late 2025 cyber-attacks on Poland's energy infrastructure to FSB Centre 16, leading to a joint sanctions package against individuals and entities involved.
This advisory from the NSA and 17 international agencies provides specific technical details and threat actor attribution, identifying FSB's Center 16 as the group exploiting CVE-2018-0171. It also expands on previous warnings by detailing the broad range of critical sectors targeted and reiterates hardening measures, including disabling Cisco Smart Install, implementing SNMPv3, and blocking specific protocols.
This updated advisory from US and international partners provides further technical details on the ongoing exploitation of network devices by Russian state-sponsored actors, specifically mentioning the use of older Cisco vulnerabilities CVE-2008-4128 and CVE-2018-0171, alongside the Cisco Smart Install feature. The advisory also highlights the broad range of critical infrastructure sectors targeted by FSB Center 16, also known as Berserk Bear, and details specific mitigation recommendations such as disabling Smart Install and enforcing stronger authentication.
This updated advisory from CISA and multiple international partners provides a deeper dive into the tactics, techniques, and procedures (TTPs) employed by Russian FSB Center 16 actors. It details their primary method of scanning for and exploiting poorly configured routers using SNMP with default community strings, and also notes occasional exploitation of specific CVEs in Cisco devices. The advisory emphasizes the broad range of critical infrastructure sectors targeted, including energy, healthcare, and government services.
This advisory from the US and its allies expands on previous warnings by specifically naming multiple Russian state-sponsored Advanced Persistent Threat (APT) groups as the actors behind these attacks. It details how these groups are exploiting poorly secured devices, particularly routers, within critical infrastructure networks to gain initial access and establish a foothold for further malicious activities. The warning emphasizes the broad scope of the threat, affecting various sectors of essential services.
This updated advisory from the UK's NCSC and international partners provides further detail on the threat actor Center 16, linked to Russia's FSB, and its methods. Beyond exploiting weak SNMP configurations and known Cisco vulnerabilities, the group is also actively scanning the internet for vulnerable devices and has historically targeted critical national infrastructure across various sectors. The warning emphasizes the need to replace legacy SNMP versions with SNMPv3, disable SNMP where unnecessary, use unique complex passwords, and restrict administrative access.
This advisory from CISA and its international partners specifically calls out Russian nation-state actors, identified as Center 16, a division of the Federal Security Service. The agencies highlight the continued exploitation of poorly configured networking devices, urging administrators to disable outdated features like Cisco's Smart Install (CVE-2018-0171) and upgrade Simple Network Management Protocol (SNMP) implementations to version 3. The advisory also emphasizes basic security hygiene such as using strong, unique passwords and implementing network segmentation to restrict remote administrative access.