CISA, NSA, FBI, the Defense Cyber Crime Center (DC3), and fifteen international partners — including the UK’s NCSC, and agencies from Australia, Canada, France, Germany, and nine other nations — published a coordinated advisory on 14 July 2026 warning of sustained Russian state-sponsored targeting of network infrastructure across six critical sectors. The campaign is attributed to FSB Center 16, Russia’s signals intelligence unit, which has been systematically mapping and compromising internet-facing routers to gain footholds in communications, defence industrial base, energy, financial services, government, and healthcare organisations globally.
What Is Happening
The advisory documents a multi-stage intrusion pattern focused on the perimeter: FSB Center 16 actors scan for routers accepting default or weak SNMP community strings, then use spoofed IP addresses to retrieve device configuration files via TFTP. Those configuration files expose network topology, credential hashes, routing tables, and access control lists — giving attackers the reconnaissance they need to plan deeper intrusions without triggering endpoint detection.
Beyond SNMP exploitation, the advisory notes actors are also exploiting known, unpatched CVEs in network devices to gain direct code execution on edge hardware. Once inside, they maintain access through legitimate management interfaces rather than deploying custom implants, making detection harder.
The campaign builds on activity the FBI attributed to FSB Center 16 in an August 2025 public service announcement. The 14 July advisory signals that targeting has broadened and intensified — warranting a full Five Eyes-plus response.
Why This Matters
Router-level compromise is a force multiplier. A single compromised edge device provides persistent network access that sits above endpoint monitoring and below the visibility of most SIEM deployments. Configuration exfiltration enables targeted follow-on attacks: attackers know which systems are present, how they’re segmented, and where credentials are likely reused.
For operators in the targeted sectors — particularly communications providers who manage third-party network infrastructure and energy operators running OT-adjacent corporate networks — router compromise can serve as the initial access vector for attacks that eventually reach operational systems. The advisory specifically flags defence industrial base organisations, which face dual exposure: corporate network compromise and potential supply chain risk to defence customers.
The breadth of the Five Eyes-plus coalition issuing this advisory — 16 agencies across 12 countries — is unusual and signals high confidence in attribution and in the current operational tempo of the campaign.
Recommended Actions
The advisory’s core mitigations are straightforward but require operational discipline to implement across large estate:
- Change default SNMP community strings on all network devices, or disable SNMP v1/v2 entirely in favour of SNMPv3 with authentication.
- Restrict management interface access — router management (SSH, HTTPS, SNMP) should be reachable only from dedicated out-of-band management networks, never from the general internet.
- Audit device inventories for known vulnerable firmware and apply patches for publicly disclosed CVEs. Devices that cannot be patched should be prioritised for replacement.
- Monitor for configuration file exfiltration — unusual TFTP traffic originating from or destined to network devices should trigger investigation.
- Review credential reuse between network devices and broader Active Directory or cloud identity environments; configuration file compromise frequently reveals credentials that work elsewhere.
The full advisory, including Snort rules and IOC lists, is available from CISA at the linked source.