What happened
US cybersecurity agencies, together with counterparts from more than a dozen allied nations, have issued a joint advisory warning that Russian state-sponsored hackers linked to the Federal Security Service’s (FSB) Center 16 continue to exploit poorly secured routers and networking devices to infiltrate critical infrastructure organizations.
According to the advisory, the threat actors, tracked under names including Energetic Bear, Crouching Yeti, Ghost Blizzard (Turla), and Static Tundra, primarily gain initial access by scanning for exposed Simple Network Management Protocol (SNMP) services that still use factory-default or weak passwords. Once compromised, affected devices are instructed to send configuration files to attacker-controlled servers using Trivial File Transfer Protocol (TFTP) or FTP.
The advisory also notes that the attackers exploit known Cisco vulnerabilities and abuse Cisco Smart Install (SMI), techniques that have remained effective because many organizations have not addressed long-standing security weaknesses.
The warning coincided with the United Kingdom and the European Union jointly imposing sanctions on 24 Russian individuals and organizations linked to cyberattacks, election interference, and disinformation campaigns. Officials also formally attributed a failed January attack on Poland’s energy grid to FSB Center 16.
Who is affected
Organizations operating critical infrastructure face the greatest risk. The advisory specifically identifies the defense industrial base, energy providers, financial services organizations, government agencies, and healthcare institutions as primary targets.
Any organization relying on internet-facing routers, switches, or networking equipment with weak authentication, outdated configurations, or unsupported protocols may also be vulnerable. Since networking devices often provide a pathway into larger enterprise environments, a single compromised router can expose an organization’s broader infrastructure.
Why CISOs should care
The latest advisory reinforces an important lesson: sophisticated threat actors continue to succeed by exploiting basic security gaps rather than relying solely on zero-day vulnerabilities.
Security agencies emphasized that weak passwords, legacy protocols, exposed management services, and poor device configuration remain common entry points for nation-state attackers. These weaknesses are often preventable through routine security hygiene.
John Strand, owner of Black Hills Information Security, noted that defenders have understood many of these attack techniques for more than a decade. The challenge is not a lack of knowledge but consistently applying fundamental security controls across enterprise networks.
3 practical actions
- Replace default credentials with strong, unique passwords on all routers, switches, and other network devices.
- Disable Cisco Smart Install where it is not required, migrate from SNMPv1 to SNMPv3, and restrict unnecessary TFTP and management traffic.
- Continuously monitor network devices for unusual SNMP activity, configuration changes, and unauthorized account creation to detect potential intrusions early.
