Allied Intelligence — 2026-07-14

Finnish Intelligence Services Warn Companies of Ongoing Russian FSB Cyber Espionage Campaign Targeting Network Infrastructure

BLUFCoordinated attribution and sanctions signal allied frustration but are unlikely to alter FSB Center 16 operations that have persisted through a decade of prior exposure and diplomatic protest.

Finland's Supo and Defence Intelligence Agency warned companies on Monday of an ongoing Russian cyber espionage campaign targeting corporate network infrastructure rather than home routers 12. The warning is part of a joint advisory issued the same day by the US NSA, CISA, FBI and intelligence services from more than a dozen countries attributing the activity to FSB Center 16, tracked in industry reporting as Berserk Bear, Energetic Bear, Dragonfly and Static Tundra 23. The advisory says the actors scan for poorly configured devices with exposed SNMP agents and exploit Cisco Smart Install misconfigurations to exfiltrate device configuration files via TFTP, and recommends SNMPv3 adoption, strong credentials and restricted management access 3. Separately, the European Council accused the FSB of sustained intrusions against EU governments and infrastructure in France, Germany, Poland, Cyprus, the Netherlands, Austria, Slovakia and Romania, prompting Finnish Foreign Minister Elina Valtonen to summon Russia's ambassador, with France and Germany announcing similar summonses and the EU and UK imposing coordinated sanctions on nine people and four entities 14.

Analysis
Joint attribution by more than a dozen intelligence services, paired with EU sanctions and ambassador summonses in Helsinki, Paris and Berlin, elevates a routine technical advisory into coordinated diplomatic pressure on Moscow, resting on two primary releases (Supo's own advisory and the CISA-led multinational bulletin) independently corroborated by Finnish press reporting on the diplomatic response. Corporate network defenders now bear the burden of hardening SNMP and Cisco Smart Install configurations that FSB Center 16 has exploited for over a decade, and the campaign's attributed near-miss against Poland's power grid last winter signals sabotage potential beyond espionage collection. The timing may reflect Western deterrence signaling and alliance cohesion as much as fresh intelligence on FSB tradecraft, and diplomatic censure carries limited coercive weight against an intrusion set Supo itself calls continuous and opportunistic rather than campaign-driven.

4 sources

Supo warns companies of Russian cyber espionage campaign - YLE News
Suojelupoliisi ja sotilastiedustelu varoittavat yrityksiä Venäjän FSB:n verkkovakoilusta - Supo (Finnish Security and Intelligence Service)
Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting - CISA
Finland summons Russian ambassador over cyber campaign - Helsinki Times