19 organizations in 13 countries warn that Russian government-backed hackers are targeting poorly configured routers.

Nineteen agencies from 13 countries, including the U.S. National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), and the Federal Bureau of Investigation (FBI), have issued a joint warning that attackers linked to the Russian Federal Security Service (FSB) Center 16 are continuing to illegally access routers around the world, targeting critical infrastructure such as communications and energy.

Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting | CISA

https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4541059/nsa-and-partners-release-guidance-on-improving-router-hygiene-to-protect-agains/

The US government warns that Russia state hackers are coming after your router | Ars Technica
https://arstechnica.com/security/2026/07/the-us-government-warns-that-russia-state-hackers-are-coming-after-your-router/

The joint recommendations were published on July 13, 2026, with participation from organizations in the United States, Australia, Canada, New Zealand, the United Kingdom, the Czech Republic, Denmark, Estonia, Finland, France, Italy, Poland, and Sweden. The participating organizations strongly urge router owners and network administrators to take measures against attacks supported by the Russian government.

According to the recommendations, attackers at FSB Center 16 have been gaining unauthorized access to poorly configured network equipment and equipment with known vulnerabilities for over a decade. The sectors particularly vulnerable are communications, defense infrastructure, energy, financial services, government services, government facilities, healthcare, and public health, with state and local governments being the primary targets within the government sector.

Security companies are tracking this activity under names such as 'Berserk Bear,' 'Energetic Bear,' 'Crouching Yeti,' 'Dragonfly,' 'Ghost Blizzard,' and 'Static Tundra.'

The attacker's methods are as follows: First, the attacker spoofs the source IP address via a proxy and sends an SNMP request, a protocol used to check the status and change the settings of network devices, to an IP address on the internet. This allows them to search for devices that respond using SNMPv1 or SNMPv2.

Next, the system attempts to access the discovered router by specifying a default or commonly used string for the 'community string,' a shared string used for authentication in SNMPv1 and SNMPv2. If access is successful, it uses the 'OID,' which specifies device information and operations by number, to instruct the router to copy its settings to files named 'config.bkp' and 'output.txt' and send them via TFTP.

Finally, the attacker receives the sent file on a VPS they rented themselves or on an FTP server that has already been compromised.

While SNMP-based scanning is the primary attack method, attackers also exploit known vulnerabilities in Cisco products, Cisco's management function 'Cisco Smart Install,' and the web portal used to manage network devices. Many of these methods overlap with the activities of other attackers such as ' Salt Typhoon .'

A compromised router can also serve as a relay point to conceal other attacks. According to the technology media outlet Ars Technica, attackers use routers as 'exit nodes' to make it appear as if malicious communications originated from that router's IP address. This reduces the likelihood of the traffic being blocked by firewalls or other security measures by routing it through a legitimate device with a trusted IP address. Ars Technica points out that 'in recent years, attackers supported by the Chinese government have also been using compromised network devices as relay points in a similar manner.'

The joint recommendations suggest that network administrators take the following actions:

Disable Cisco Smart Install on all devices.

Use SNMPv3 instead of SNMPv1 and SNMPv2. Enable 'authPriv' for authentication and encryption, and set the latest encryption method supported by the device. If SNMPv1 or SNMPv2 is required, change the community string from its default setting to read-only.

- Set strong, unique passwords for local accounts on network devices and securely store authentication information.

- Use an allow list in a MIB (Model-Information Bag) that consolidates information managed by SNMP to monitor and restrict access to OIDs. Configure intrusion detection system (IDS) rules to detect SNMP Set-Requests that target highly sensitive device information.

- Use Access Control Lists (ACLs) to restrict access to management protocols such as SNMP to management equipment only. If possible, use an out-of-band network separated from normal business communications.

Except when absolutely essential for business operations, network boundary firewalls and devices will block external communications using UDP port '69' (TFTP), TCP port '4786' (SMI), UDP ports '161' and '162' (SNMP), and TCP/UDP ports '10161' and '10162' (SNMPv3).

- Update the software and firmware images of network devices to fix known vulnerabilities. Replace end-of-support devices with supported products.

The joint recommendations focus on the activities of the FSB's 16th center, but these measures are also effective in detecting and countering similar tactics used by other attackers.