Allied Intelligence — 2026-07-20

Twelve-Country Alliance Issues Joint Advisory Attributing Critical Infrastructure Attacks to Russian FSB Centre 16

BLUFCoupling twelve-nation attribution with individual sanctions converts neglected Cisco router patching from an accepted risk into a documented liability for critical infrastructure operators.

A joint advisory signed by 18 agencies from 12 countries, including the NSA, CISA, the FBI, and the UK's National Cyber Security Centre, attributed a campaign dating back more than a decade against critical network infrastructure to Centre 16, a unit of Russia's Federal Security Service also tracked as Berserk Bear, Energetic Bear, and Static Tundra 12. Australia, Canada, the Czech Republic, Denmark, Estonia, Finland, France, Italy, New Zealand, Poland, Sweden, and the United States joined the UK in signing the advisory, which describes the group scanning for routers with weak or default SNMP credentials to copy device configurations to attacker infrastructure via TFTP, alongside exploiting poorly configured network devices, primarily Cisco routers, and Cisco's Smart Install feature 23. Targeted sectors span communications, defense, energy, financial services, government facilities, and healthcare 3. Separately, the UK and EU sanctioned Centre 16 in their first coordinated cyber sanctions package, tied to a thwarted December 2025 attack on Poland's energy grid that could have cut power to 500,000 people in winter, part of a wider list of 24 individuals and entities linked to Russian intelligence, including GRU leadership 2.

Analysis
A joint 18-agency, 12-country advisory formalizes years of quiet FSB exploitation of unpatched Cisco Smart Install devices into multilateral attribution, obligating operators across six critical sectors to remediate router configurations that have been publicly known as vulnerable since 2018. Convergence rests on a single primary release from CISA, the FBI, and NSA, with secondary outlets amplifying rather than independently corroborating. Pairing the disclosure with UK and EU sanctions on Centre 16 over the foiled December Poland grid attack hardens the link between cyber attribution and sanctions enforcement against Russian intelligence figures, including GRU officers. The release may instead function primarily as diplomatic and sanctions signaling timed to the Poland case rather than as a response to newly discovered tradecraft.

4 sources

Joint Cybersecurity Advisory: Russian FSB Center 16 Cyber Actors Targeting Network Devices - CISA/FBI/NSA
NCSC issues warning over Russian attacks on critical infrastructure - PublicTechnology
Russia's FSB attacks critical infrastructure, says 12 Western nations - SC Media
Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting (AA26-194A) - CISA/NSA/FBI/DC3