US and Allies Issue Warning Over Russian Threats to Critical Infrastructure

Key Takeaways

• A multinational coalition led by the U.S. NSA, FBI, and CISA, together with agencies from eight allied nations, has warned that Russian state‑linked hackers (FSB Center 16) are exploiting poorly configured routers to gain footholds in critical‑infrastructure networks.
• The attackers primarily scan for devices using default or weak SNMP community strings, then exfiltrate configuration files via TFTP; they also leverage the long‑known Cisco Smart Install flaw (CVE‑2018‑0171) and web‑portal vulnerabilities.
• Energy, communications, defense industrial base, healthcare, financial services, defense, and state/local government sectors are the most exposed.
• Mitigation steps include upgrading to SNMPv3, disabling Cisco Smart Install, enforcing strong unique passwords, blocking TFTP and SNMP at edge firewalls, patching firmware, and replacing end‑of‑life gear.
• A separate but related operation (FrostArmada) disrupted a massive router‑hijacking campaign by APT28 (GRU‑linked Fancy Bear), underscoring the breadth of Russian‑state cyber activity targeting networking equipment.

Overview of the Joint Advisory
In early 2025, the United States National Security Agency (NSA), Federal Bureau of Investigation (FBI), and Cybersecurity and Infrastructure Security Agency (CISA) released a joint cybersecurity advisory that was co‑authorized by fifteen additional agencies from Australia, the United Kingdom, Canada, New Zealand, Estonia, Finland, France, and Italy. The advisory consolidates intelligence gathered over several months concerning a sustained campaign by Russian state‑sponsored actors aimed at compromising networking devices that sit at the perimeter of critical‑infrastructure environments. By presenting a unified front, the signatory nations aim to raise awareness among network administrators, encourage rapid adoption of defensive measures, and signal a coordinated diplomatic and legal response to the threat.

Attribution to FSB Center 16 and Alias Names
The advisory attributes the intrusions to hackers operating out of the Russian Federal Security Service (FSB) Center 16, a unit known for conducting cyber‑espionage against governmental and industrial targets. Security researchers have tracked this group under a variety of monikers—Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard, and Static Tundra—reflecting the evolution of its tools and tactics over time. The use of multiple aliases helps the actors obscure their identity while allowing defenders to correlate activity across different threat‑intelligence feeds. The joint advisory explicitly links these aliases to the same FSB Center 16 infrastructure, reinforcing the assessment that the observed activity is state‑directed rather than the work of independent cybercriminals.

Attack Methodology: SNMP Scanning and Configuration Exfiltration
The core of the campaign involves internet‑wide scanning for routers that still accept default or weakly configured Simple Network Management Protocol (SNMP) community strings. Once a responsive device is identified, the attackers issue SNMP set commands—often using spoofed source IP addresses to hinder attribution—to retrieve the router’s running configuration. The configuration file is then transferred to actor‑controlled servers via the Trivial File Transfer Protocol (TFTP), a lightweight protocol frequently left enabled on legacy equipment for convenience. By obtaining the configuration, the adversaries gain insight into access‑control lists, VPN tunnels, authentication credentials, and other sensitive settings that can be leveraged for lateral movement, persistence, or the creation of covert channels within the victim’s network.

Exploitation of Cisco Smart Install (CVE‑2018‑0171)
In addition to SNMP‑based reconnaissance, the advisory notes that the same threat actor has been actively exploiting a critical vulnerability in Cisco’s Smart Install (SMI) feature, tracked as CVE‑2018‑0171, since at least November 2021. Smart Install is a zero‑touch provisioning service designed to simplify the deployment of Cisco switches and routers; when left enabled and exposed to the internet, it allows unauthenticated attackers to execute arbitrary commands, upload malicious images, or rewrite device firmware. The FBI’s August 2025 warning highlighted that this flaw remains a viable entry point because many organizations have not disabled the service or applied the necessary patches, despite the availability of mitigation guidance for several years.

Sectors Most at Risk
The advisory identifies several high‑value sectors that are disproportionately targeted due to their reliance on legacy networking gear and the potential impact of disruption. These include energy generation and distribution, telecommunications, the defense industrial base, healthcare providers, financial institutions, broader defense organizations, and state and local government services. Compromise of routers in any of these areas can facilitate espionage, sabotage, or ransomware deployment, potentially affecting essential services such as power grids, emergency response networks, or payment processing systems. The cross‑sector nature of the threat underscores the need for a holistic, sector‑agnostic approach to device hardening.

Mitigation Measures Recommended by Authorities
To counter the observed tactics, the joint advisory prescribes a concrete set of hardening steps:

1. Upgrade SNMP to version 3 – SNMPv3 provides authentication and encryption, eliminating the risk of clear‑text community strings.
2. Disable Cisco Smart Install – Unless required for legitimate zero‑touch deployment, the service should be turned off and blocked at the network edge.
3. Enforce strong, unique passwords – Default or easily guessable credentials must be replaced with complex passwords stored in a secure vault.
4. Block TFTP and SNMP traffic at edge firewalls – Limiting inbound access to these protocols reduces the attack surface to only authorized management stations.
5. Update software and firmware – Apply the latest patches from vendors, particularly for Cisco IOS/IOS XE and any third‑party router OS.
6. Replace end‑of‑life devices – Hardware that no longer receives security updates should be retired and substituted with supported models.

Implementation of these controls, combined with continuous monitoring for anomalous SNMP or TFTP activity, significantly reduces the likelihood of successful intrusion.

Connection to the FrostArmada Operation
The advisory situates the current router‑targeting campaign within a broader pattern of Russian‑state cyber activity, citing a recent international law‑enforcement operation that disrupted FrostArmada. FrostArmada was attributed to APT28 (also known as Fancy Bear or Forest Blizzard), a GRU‑linked group (unit 26165) that had compromised roughly 18,000 MikroTik and TP‑Link small‑office/home‑office (SOHO) routers across 120 countries by December 2025. In that operation, attackers altered the devices’ DNS settings to redirect authentication traffic to attacker‑controlled servers, thereby harvesting Microsoft 365 credentials and OAuth tokens. With judicial authorization from the U.S. Department of Justice and assistance from Polish authorities and multiple cybersecurity firms, the FBI executed a remote remediation that restored legitimate DNS resolvers on the compromised routers. The FrostArmada takedown illustrates both the scale of router‑based threats and the feasibility of coordinated defensive actions when governments, law enforcement, and private sector partners collaborate.

Implications for Network Defenders
The combined evidence from the joint advisory and the FrostArmada disruption highlights several strategic implications for organizations responsible for critical infrastructure:

• Perimeter devices are high‑value targets. Routers, switches, and firewalls often sit outside the traditional endpoint protection umbrella, making them attractive footholds for adversaries seeking stealthy persistence.
• Legacy protocols remain exploitable. SNMPv1/v2c and TFTP, though outdated, are still prevalent in many environments due to oversight or misconfiguration.
• Patch management must extend to networking gear. Vendors regularly release firmware fixes, yet many organizations prioritize server and workstation updates over hardware appliances.
• Visibility is crucial. Logging SNMP queries, TFTP transfers, and unauthorized configuration changes enables early detection of reconnaissance or exfiltration attempts.
• International cooperation amplifies defense. Sharing indicators of compromise (IoCs) across borders, as demonstrated in the joint advisory and FrostArmada response, raises the cost for attackers and improves collective resilience.

Conclusion and Call to Action
The warning issued by the NSA‑FBI‑CISA coalition and its international partners serves as a stark reminder that nation‑state actors continue to exploit the simplest weaknesses—default passwords and outdated services—to infiltrate the networks that underpin modern society. By adhering to the prescribed mitigations—upgrading SNMP, disabling Smart Install, enforcing robust credentials, blocking risky protocols, maintaining up‑to‑date firmware, and retiring obsolete equipment—network defenders can materially raise the bar for adversaries such as FSB Center 16 and APT28. Simultaneously, organizations should invest in continuous monitoring, incident‑response planning, and cross‑sector information sharing to detect and thwart any attempts that slip through preventive controls. In an era where a single compromised router can cascade into widespread disruption, proactive hardening of networking infrastructure is not merely advisable; it is essential to the security and stability of critical services worldwide.