IC Technology & Cyber — 2026-07-13

NSA and 17 Allied Agencies Issue Joint Advisory on Russian FSB Center 16 Router Targeting Campaign

BLUFCoordinated sanctions and attribution alongside yet another advisory on decade-old vulnerabilities confirm that slow patching across critical infrastructure, not inadequate threat intelligence, remains the core defensive failure.

The NSA and 18 partner agencies from 12 additional countries issued a joint cybersecurity advisory on Monday on Russian FSB Center 16, warning the group is exploiting poorly configured and vulnerable network devices to compromise critical infrastructure worldwide 123. The advisory states the actor, also tracked as Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly and Static Tundra, scans for routers using default or weak SNMP passwords and has separately exploited known Cisco vulnerabilities, including Smart Install flaws and CVEs from 2008 and 2018 12. Recommended defenses include disabling Cisco Smart Install, moving to SNMPv3, and enforcing strong device authentication 2. Sectors named as most affected include defense, communications, energy, financial services, government and healthcare 12. The advisory's release coincided with UK sanctions against 24 individuals and entities and a joint UK-EU attribution of a December 2025 attack on Poland's energy grid to FSB Center 16 12.

Analysis
The advisory formalizes attribution and defensive guidance for a router-targeting pattern Center 16 has sustained for over a decade, pointing affected sectors toward retiring legacy Cisco Smart Install exposure and weak SNMP authentication rather than confronting novel tradecraft. Pairing the release with UK sanctions and the joint UK-EU attribution of the Poland grid attack signals coordinated Western escalation into political costs for Moscow beyond technical guidance alone, though the timing may reflect that diplomatic signal more than any real shift in Center 16's tradecraft, which by NCSC's own account has stayed opportunistic and largely unchanged for years. Both primary sources are co-signatories of the same joint release, with secondary accounts restating it, capping confidence beyond the advisory's own text. A near-identical FBI alert on the same group roughly a year earlier indicates the binding constraint on defense is slow patching across critical infrastructure operators, not gaps in threat intelligence.

4 sources

Officials once again warn defenders that Russian hackers are targeting network devices - CyberScoop
UK and Allies urge critical sectors to improve defences against Russian intelligence targeting - National Cyber Security Centre (UK)
Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting (CSA) - National Security Agency
US and allies warn of Russian critical infrastructure attacks - BleepingComputer