Technology and Science13 July, 20263 min read
US Warns Russia FSB Center 16 Hackers Target Vulnerable Routers Worldwide
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Russian state hackers are actively compromising vulnerable routers worldwide to infiltrate networks. The warnings come from a multinational advisory by NSA, FBI, CISA and partners.
Router targeting campaign
The US government warned users of home and small office routers to secure their devices as Russia state hackers continue to mass-compromise them for use in obscuring nefarious actions against sensitive organizations. Ars Technica said the Cybersecurity and Infrastructure Security Agency warned Monday that “Russian Federal Security Service (FSB) Center 16 cyber actors continue to exploit poorly configured and vulnerable networking devices worldwide,” and it described the primary compromise method as scanning IP ranges for routers with active Simple Network Management Protocol (SNMP) agents that accept common or default authentication credentials. BleepingComputer reported that the joint advisory attributed the attacks to hackers from the Russian Federal Security Service (FSB) Center 16, describing how they scan internet-connected IP address ranges for routers accepting default or common SNMP authentication strings.
The same report said the attackers then issue commands using spoofed IP addresses to copy device configuration files and exfiltrate them via the Trivial File Transfer Protocol to actor-controlled servers. Ars Technica added that the actions to date are “little more than whack-a-mole exercises” as operators replace their botnets with new ones.
Mitigations and official warnings
The joint advisory described by BleepingComputer urged defenders to harden networks against Center 16 by upgrading to SNMPv3, disabling Cisco Smart Install, enforcing strong unique passwords, and blocking TFTP and SNMP traffic at edge firewalls. Ars Technica said the advisory was co-issued by governments from around the world, including Australia, Denmark, New Zealand, and the UK, and it said the hacking groups are tracked under names including Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard, and Static Tundra. BleepingComputer quoted the UK National Cyber Security Centre warning on Monday that “Centre 16 [..] has been seen hunting for vulnerable routers by scanning the internet for devices that still use default or weak Simple Network Management Protocol (SNMP) passwords.”
The same BleepingComputer report added that the UK National Cyber Security Centre said the actor “have also exploited well-known vulnerabilities relating to Cisco devices, Cisco's Smart Install (SMI) feature and web-portal flaws to gain control of network devices.” Ars Technica also said Google and other companies worked to disrupt the massive botnets that control compromised routers in lockstep.
Broader impact and diplomacy
Beyond the router-focused campaign, Infosecurity Magazine reported that the UK and European Union attributed coordinated cyber-attacks targeting Poland’s energy infrastructure in late 2025 to FSB Center 16, and it cited a UK government statement issued on July 13. Infosecurity Magazine quoted the UK government saying: “This reckless attack failed but could have caused 500,000 citizens to lose electricity in the depths of winter,” and it described the statement as “another example of the Russian state’s irresponsible attempts to sow chaos across Europe.” Yle reported that the Finnish Security Intelligence Service (Supo) and the Finnish Defence Intelligence Agency were warning companies about an ongoing Russian cyber espionage campaign targeting vulnerable network devices, with Supo saying the threat is aimed primarily at corporate network infrastructure, not the home internet routers previously highlighted.
Yle added that Finnish Foreign Minister Elina Valtonen (NCP) summoned Russia's ambassador to Finland for questioning regarding Moscow's malicious cyber activities, and it said France, Germany and the UK also said they would summon the Russian ambassadors in their countries. Yle further reported that the European Council accused Russia's Federal Security Service (FSB) of conducting a sustained campaign of malicious cyber activity against the EU, its member states and international partners, particularly Ukraine.