Allied Agencies Warn Russian FSB Hackers Are Targeting Critical Infrastructure Routers
Summary
U.S. and allied agencies say FSB Center 16 hackers target poorly configured routers and exploit Cisco flaws to access critical infrastructure networks. The advisory recommends hardening routers; a separate FBI operation disrupted APT28’s FrostArmada campaign.
Key points
- A joint advisory attributes router intrusions targeting critical infrastructure to hackers linked to Russia’s FSB Center 16.
- The group scans for weak or default SNMP credentials, then uses spoofed IP addresses to copy router configurations and exfiltrate them via TFTP.
- The advisory says Cisco IOS and IOS XE Smart Install flaws, including CVE-2018-0171, have also been exploited to gain access to network devices.
- Recommended defenses include upgrading to SNMPv3, disabling Cisco Smart Install, using strong unique passwords, blocking TFTP and SNMP at edge firewalls, updating firmware, and replacing end-of-life devices.
- A separate FBI operation disrupted APT28’s FrostArmada campaign, which reportedly infected 18,000 routers across 120 countries by December 2025.
- In the FrostArmada operation, attackers altered DNS settings on MikroTik and TP-Link routers to redirect authentication traffic and steal Microsoft 365 credentials and OAuth tokens; the FBI remotely removed the malicious settings.
Article Details
- Event Type
- Joint cybersecurity advisory about Russian FSB Center 16 targeting vulnerable routers, alongside reporting on a separate law-enforcement operation that disrupted APT28’s FrostArmada campaign.
- Impact
- Router compromise puts critical infrastructure networks at risk. The FSB Center 16 activity involves stealing router configuration files and exfiltrating them to attacker-controlled servers. In the separate FrostArmada campaign, compromised routers redirected authentication traffic to steal Microsoft 365 logins and OAuth tokens; the campaign had infected 18,000 routers across 120 countries by December 2025.
MITRE ATT&CK
T1048.003 · Exfiltration Over Unencrypted Non-C2 ProtocolFSB Center 16 exfiltrates router configuration files to actor-controlled servers using TFTP.T1557.001 · Name Resolution Poisoning and SMB RelayIn the separate FrostArmada campaign, attackers altered DNS settings on compromised routers to redirect authentication traffic to attacker-controlled servers.T1595.001 · Scanning IP BlocksFSB Center 16 scans internet-connected IP address ranges to find routers accepting default or common SNMP authentication strings.
CVE
Threat Actors
APT28The article attributes the separate FrostArmada router-compromise campaign to APT28, described as a Russian military intelligence group.Berserk BearThe article identifies Berserk Bear as a tracking name for FSB Center 16, which the advisory attributes to router-targeting activity.Crouching YetiThe article identifies Crouching Yeti as a tracking name for FSB Center 16, which the advisory attributes to router-targeting activity.DragonflyThe article identifies Dragonfly as a tracking name for FSB Center 16, which the advisory attributes to router-targeting activity.Energetic BearThe article identifies Energetic Bear as a tracking name for FSB Center 16, which the advisory attributes to router-targeting activity.Fancy BearThe article gives Fancy Bear as another tracking name for APT28, which it attributes to the separate FrostArmada router-compromise campaign.FSB Center 16The advisory attributes router scanning, compromise, and configuration-file exfiltration affecting critical infrastructure to hackers from FSB Center 16.Ghost BlizzardThe article identifies Ghost Blizzard as a tracking name for FSB Center 16, which the advisory attributes to router-targeting activity.Static TundraThe article identifies Static Tundra as a tracking name for FSB Center 16, which the advisory attributes to router-targeting activity.
Vendors
CiscoThe advisory also details active exploitation of Cisco IOS, Cisco IOS XE, and Smart Install flaws, while noting a separate operation that disrupted APT28’s FrostArmada router compromise campaign.MicrosoftHackers altered DNS settings on compromised MikroTik and TP-Link small office/home office (SOHO) routers to redirect authentication traffic to attacker-controlled servers and steal Microsoft 365 logins and OAuth tokens.MikroTikHackers altered DNS settings on compromised MikroTik and TP-Link small office/home office (SOHO) routers to redirect authentication traffic to attacker-controlled servers and steal Microsoft 365 logins and OAuth tokens.TP-LinkHackers altered DNS settings on compromised MikroTik and TP-Link small office/home office (SOHO) routers to redirect authentication traffic to attacker-controlled servers and steal Microsoft 365 logins and OAuth tokens.
Products
Cisco IOSThe advisory also details active exploitation of Cisco IOS, Cisco IOS XE, and Smart Install flaws, while noting a separate operation that disrupted APT28’s FrostArmada router compromise campaign.Cisco IOS XEThe advisory also details active exploitation of Cisco IOS, Cisco IOS XE, and Smart Install flaws, while noting a separate operation that disrupted APT28’s FrostArmada router compromise campaign.Cisco Smart InstallCisco Smart Install and Cisco IOS vulnerabilities have also been used to gain device access.Microsoft 365 Apps for EnterpriseHackers altered DNS settings on compromised MikroTik and TP-Link small office/home office (SOHO) routers to redirect authentication traffic to attacker-controlled servers and steal Microsoft 365 logins and OAuth tokens.
Countries
AustraliaThe joint advisory, co-authored by the NSA, FBI, and CISA, along with 15 other agencies from Australia, the United Kingdom, Canada, New Zealand, Estonia, Finland, France, and Italy, attributes the attacks to hackersCanadaco-authored by the NSA, FBI, and CISA, along with 15 other agencies from Australia, the United Kingdom, Canada, New Zealand, Estonia, Finland, France, and Italy, attributes the attacks to hackers from the RussianEstoniaFBI, and CISA, along with 15 other agencies from Australia, the United Kingdom, Canada, New Zealand, Estonia, Finland, France, and Italy, attributes the attacks to hackers from the Russian Federal Security ServiceFinlandand CISA, along with 15 other agencies from Australia, the United Kingdom, Canada, New Zealand, Estonia, Finland, France, and Italy, attributes the attacks to hackers from the Russian Federal Security Service (FSB)Francealong with 15 other agencies from Australia, the United Kingdom, Canada, New Zealand, Estonia, Finland, France, and Italy, attributes the attacks to hackers from the Russian Federal Security Service (FSB) Center 16.Italy15 other agencies from Australia, the United Kingdom, Canada, New Zealand, Estonia, Finland, France, and Italy, attributes the attacks to hackers from the Russian Federal Security Service (FSB) Center 16.New Zealandby the NSA, FBI, and CISA, along with 15 other agencies from Australia, the United Kingdom, Canada, New Zealand, Estonia, Finland, France, and Italy, attributes the attacks to hackers from the Russian FederalUnited Kingdomadvisory, co-authored by the NSA, FBI, and CISA, along with 15 other agencies from Australia, the United Kingdom, Canada, New Zealand, Estonia, Finland, France, and Italy, attributes the attacks to hackers from theUnited StatesU.S. and allied cybersecurity agencies warned that Russian FSB Center 16 hackers are targeting weakly configured routers to break into critical infrastructure networks.
Industries
communicationsThe sectors most at risk from these attacks include energy, communications, defense industrial base, healthcare, financial services, defense, and state and local government services.DefenseThe sectors most at risk from these attacks include energy, communications, defense industrial base, healthcare, financial services, defense, and state and local government services.Defense industrial baseThe sectors most at risk from these attacks include energy, communications, defense industrial base, healthcare, financial services, defense, and state and local government services.EnergyCritical infrastructure sectors such as energy, healthcare, and government are at risk.Financial ServicesThe sectors most at risk from these attacks include energy, communications, defense industrial base, healthcare, financial services, defense, and state and local government services.HealthcareCritical infrastructure sectors such as energy, healthcare, and government are at risk.state and local government servicesThe sectors most at risk from these attacks include energy, communications, defense industrial base, healthcare, financial services, defense, and state and local government services.