US and 12 Allies Warn of Russian FSB-Linked Attacks on Network Devices
Summary
A joint advisory from the U.S. and 12 partner countries says FSB Center 16 is targeting network devices with weak credentials and old Cisco flaws, and urges defenders to disable Smart Install, strengthen authentication and monitor suspicious logins.
Key points
- Authorities say FSB Center 16 has targeted critical infrastructure across multiple sectors and countries for more than a decade.
- The group reportedly scans for routers with default or weak passwords and exploits Cisco vulnerabilities, Smart Install and web portals.
- The advisory names CVE-2008-4128 and CVE-2018-0171 among the Cisco vulnerabilities exploited.
- Defenders are advised to disable Cisco Smart Install, use stronger authentication and passwords, and monitor for unusual credentials and logins using local accounts.
- The NSA said affected sectors include defense, communications, energy, financial services, government facilities and health care.
Article Details
- Event Type
- Joint cybersecurity advisory warning about Russian state-sponsored cyber activity targeting network devices
- Impact
- Authorities said the activity has affected U.S. and foreign networks across multiple sectors. The attackers reportedly use default or weak passwords and exploit Cisco device vulnerabilities and Cisco Smart Install to take over network devices; the article does not quantify the impact.
MITRE ATT&CK
T1078.001 · Default AccountsThe group reportedly uses default or weak passwords to access network devices.T1210 · Exploitation of Remote ServicesThe group reportedly exploits vulnerabilities in Cisco devices and Smart Install to take over network devices.T1595.002 · Vulnerability ScanningThe group reportedly scans the internet for vulnerable routers.
CVE
People
Threat Actors
Berserk BearThe article identifies Berserk Bear as another tracking name for the hackers linked to FSB Center 16 and attributes the reported network-device attacks to that group.Crouching YetiThe article identifies Crouching Yeti as another tracking name for the hackers linked to FSB Center 16 and attributes the reported network-device attacks to that group.DragonflyThe article identifies Dragonfly as another tracking name for the hackers linked to FSB Center 16 and attributes the reported network-device attacks to that group.Energetic BearThe article identifies Energetic Bear as another tracking name for the hackers linked to FSB Center 16 and attributes the reported network-device attacks to that group.FSB Center 16The article attributes the reported targeting of critical infrastructure and exploitation of networking devices to Russian state-sponsored hackers linked to FSB Center 16.Ghost BlizzardThe article identifies Ghost Blizzard as another tracking name for the hackers linked to FSB Center 16 and attributes the reported network-device attacks to that group.Static TundraThe article identifies Static Tundra as another tracking name for the hackers linked to FSB Center 16 and attributes the reported network-device attacks to that group.
Vendors
Products
Countries
AustraliaOther countries behind the joint cybersecurity advisory include: Canada, Australia, New Zealand, Czech Republic, Denmark, Estonia, Finland, France, Italy, Poland and Sweden.CanadaOther countries behind the joint cybersecurity advisory include: Canada, Australia, New Zealand, Czech Republic, Denmark, Estonia, Finland, France, Italy, Poland and Sweden.Czech RepublicOther countries behind the joint cybersecurity advisory include: Canada, Australia, New Zealand, Czech Republic, Denmark, Estonia, Finland, France, Italy, Poland and Sweden.DenmarkOther countries behind the joint cybersecurity advisory include: Canada, Australia, New Zealand, Czech Republic, Denmark, Estonia, Finland, France, Italy, Poland and Sweden.EstoniaOther countries behind the joint cybersecurity advisory include: Canada, Australia, New Zealand, Czech Republic, Denmark, Estonia, Finland, France, Italy, Poland and Sweden.FinlandOther countries behind the joint cybersecurity advisory include: Canada, Australia, New Zealand, Czech Republic, Denmark, Estonia, Finland, France, Italy, Poland and Sweden.FranceOther countries behind the joint cybersecurity advisory include: Canada, Australia, New Zealand, Czech Republic, Denmark, Estonia, Finland, France, Italy, Poland and Sweden.ItalyOther countries behind the joint cybersecurity advisory include: Canada, Australia, New Zealand, Czech Republic, Denmark, Estonia, Finland, France, Italy, Poland and Sweden.New ZealandOther countries behind the joint cybersecurity advisory include: Canada, Australia, New Zealand, Czech Republic, Denmark, Estonia, Finland, France, Italy, Poland and Sweden.PolandOn Monday, the European Union blamed Russia’s FSB Center 16 for a December 2025 attack on Poland’s energy grid.RussiaOn Monday, the European Union blamed Russia’s FSB Center 16 for a December 2025 attack on Poland’s energy grid.SwedenOther countries behind the joint cybersecurity advisory include: Canada, Australia, New Zealand, Czech Republic, Denmark, Estonia, Finland, France, Italy, Poland and Sweden.United StatesThe joint advisory from the United States and 12 other countries urges defenders to disable Cisco Smart Install, strengthen authentication, and watch for suspicious logins.
Industries
communicationsand foreign networks across multiple sectors, including the defense industrial base, communications, energy, financial services, government facilities and health care sectors,” the National Security Agency said in aDefense industrial baseand foreign networks across multiple sectors, including the defense industrial base, communications, energy, financial services, government facilities and health care sectors,” the National Security Agency said in aEnergyand foreign networks across multiple sectors, including the defense industrial base, communications, energy, financial services, government facilities and health care sectors,” the National Security Agency said in aFinancial Servicesnetworks across multiple sectors, including the defense industrial base, communications, energy, financial services, government facilities and health care sectors,” the National Security Agency said in a statement.government facilitiessectors, including the defense industrial base, communications, energy, financial services, government facilities and health care sectors,” the National Security Agency said in a statement.Healthcarethe defense industrial base, communications, energy, financial services, government facilities and health care sectors,” the National Security Agency said in a statement.