Key Takeaways
- A Russian state‑sponsored cyber unit (FSB Centre 16, also known as Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard, Static Tundra) is scanning the internet for routers with weak or default SNMP credentials.
- The advisory, issued jointly by agencies from 12 nations, urges organizations in communications, defence, energy, finance, government, and healthcare to upgrade to SNMPv3 and harden device configurations.
- Exploitation of weak SNMP community strings enables attackers to pull router configurations via TFTP, which are then exfiltrated to threat‑actor‑controlled servers.
- Centre 16 has also revived a seven‑year‑old Cisco Smart Install vulnerability (CVE‑2018‑0171) affecting unpatched, often end‑of‑life devices.
- The group’s tactics, techniques, and procedures (TTPs) overlap with those of China‑linked Slat Typhoon, indicating shared tradecraft among state‑backed actors.
- The UK and EU have officially attributed the late‑2025 cyber‑attack on Poland’s energy grid to Centre 16 and have imposed coordinated sanctions on 24 individuals and entities linked to Russian intelligence services.
- The UK is additionally sanctioning operators of the Lumma Stealer malware, which has compromised over 2,100 UK victims in the past six months and supplied credentials for broader espionage campaigns.
- Mitigation steps include disabling or securing SNMP, applying Cisco patches or disabling Smart Install, monitoring for anomalous TFTP traffic, and implementing multi‑factor authentication and network segmentation.
- Continuous vigilance, threat‑intelligence sharing, and timely patch management remain essential to defend against this persistent, globally‑targeted threat.
Overview of the Joint Advisory
In early 2026, cybersecurity authorities from Australia, Canada, the Czech Republic, Denmark, Estonia, Finland, France, Italy, New Zealand, Poland, Sweden, the United Kingdom, and the United States released a coordinated warning about a Russian state‑sponsored hacking unit actively probing routers worldwide. The advisory details how the group leverages weak Simple Network Management Protocol (SNMP) settings to gain unauthorized access, extract device configurations, and use those credentials for further intrusion. By pooling intelligence from multiple allied nations, the notice aims to raise awareness across critical infrastructure sectors and provide concrete defensive guidance before the threat can cause widespread disruption.
Threat Actor Identity and Aliases
The threat actor identified in the advisory is the Russian Federal Security Service (FSB) Centre 16, a unit notorious for cyber espionage and disruptive operations. Over the years, security researchers have tracked the same group under numerous monikers, including Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard, and Static Tundra. Each alias reflects a different campaign or toolset observed by various vendors, but forensic analysis confirms they stem from the same FSB‑backed entity. Recognizing these interchangeable names helps defenders correlate disparate alerts and attribute activity accurately to the Russian state.
Targeted Sectors and Vulnerability Focus
The advisory highlights that sectors deemed most at risk include communications, defence, energy, financial services, government, and healthcare—industries where router compromise could lead to service outages, data theft, or sabotage. Centre 16’s scanning efforts specifically hunt for devices that still rely on default or easily guessable SNMP community strings, a common oversight in legacy deployments. By focusing on these weakly protected management interfaces, the actors can infiltrate a broad swath of networks without needing sophisticated zero‑day exploits, making the threat both pervasive and cost‑effective for the attackers.
SNMP Weakness Exploitation Mechanics
SNMP versions 1 and 2c transmit community strings in plaintext, rendering them vulnerable to network sniffing. When Centre 16’s scanners discover a router exposing such a string, they can authenticate as a legitimate management station. Once authenticated, the attackers issue Object Identifier (OID) queries that instruct the router to dump its running configuration. Running‑Config or Startup‑Config files. These configuration files contain sensitive data such as interface settings, routing protocols, VPN keys, and access‑control lists, providing a treasure trove for further lateral movement or credential harvesting.
Use of TFTP for Configuration Exfiltration
After obtaining a router’s configuration via SNMP, Centre 16 leverages the Trivial File Transfer Protocol (TFTP) to move the files off the device. The attackers configure the router to TFTP‑put the extracted configuration to a server under their control—often a leased virtual private server (VPS) or a compromised file‑transfer host. TFTP’s lack of authentication and encryption makes it an ideal conduit for stealthy data exfiltration, allowing the threat actors to harvest router settings at scale while leaving minimal forensic traces on the victim network.
Exploitation of Cisco Smart Install CVE‑2018‑0171
Beyond SNMP abuse, the advisory notes that Centre 16 has periodically exploited known vulnerabilities in Cisco equipment. In 2025, Cisco re‑issued warnings about CVE‑2018‑0171, a seven‑year‑old flaw in the Smart Install feature that allows unauthenticated remote code execution on affected, often end‑of‑life, devices. The vendor urged customers to either apply the patch released in 2018 or disable Smart Install if patching is infeasible. Centre 16’s continued use of this old vulnerability underscores the group’s reliance on low‑effort, high‑impact exploits when organizations neglect routine updates.
Overlap with Other Threat Groups
The joint advisory observes that many of the tactics, techniques, and procedures (TTPs) employed by Centre 16 overlap with those used by the China‑linked group Slat Typhoon. Shared behaviors include scanning for weak SNMP strings, leveraging TFTP for configuration theft, and repurposing older Cisco vulnerabilities. This convergence suggests either a sharing of tools and infrastructure among state‑backed actors or independent development of similar tradecraft due to the effectiveness of these methods against poorly hardened network devices.
Attribution of Poland Energy Grid Attack
Concurrent with the advisory’s release, the United Kingdom and the European Union officially attributed the late‑2025 cyber‑attack targeting Poland’s energy infrastructure to FSB Centre 16. In a public statement, the UK government described the operation as “reckless” and warned that, had it succeeded, it could have left approximately 500,000 citizens without electricity during winter depths. The attribution underscores the group’s willingness to conduct disruptive actions that pose tangible risks to civilian populations and critical national services.
EU and UK Joint Sanctions and Response
Following the attribution, the EU and UK unveiled a coordinated sanctions package targeting 24 individuals and entities believed to be behind the destructive cyber and hybrid operations, including cybercriminals operating proxy networks linked to Russian intelligence services. The sanctions freeze assets, restrict travel, and prohibit dealings with the designated persons. Additionally, the UK announced separate sanctions against operators of the Lumma Stealer malware, alleging that Russia has used stolen credentials harvested by this tool to conduct global cyber‑espionage campaigns supporting Kremlin objectives.
Lumma Stealer Connection and Impact in UK
The UK’s National Crime Agency reported that, within the last six months, over 2,100 victims in the United Kingdom have been compromised by Lumma Stealer. This information‑stealing malware harvests login credentials, banking data, and other sensitive information from infected endpoints. The stolen data has allegedly been fed into broader Russian intelligence operations, enabling credential‑based access to governmental, corporate, and personal accounts. The scale of Lumma infections demonstrates how ancillary cybercrime tools can be weaponized to augment state‑sponsored espionage and disruption efforts.
Recommendations for Mitigation
Defenders are urged to implement several concrete measures: replace SNMPv1/v2c with SNMPv3, which provides authentication and encryption; change default community strings to strong, unique values or disable SNMP entirely if not needed; monitor network traffic for anomalous TFTP requests, especially those directed to unfamiliar external IPs; apply the Cisco patch for CVE‑2018‑0171 or disable Smart Install where patching is not feasible; enforce network segmentation to isolate management interfaces; and deploy multi‑factor authentication for privileged access. Regular vulnerability scanning and timely patch management remain foundational to reducing the attack surface that Centre 16 exploits.
Conclusion and Ongoing Vigilance
The recent joint advisory and accompanying attributions reveal a persistent, globally‑scoping threat from Russian state‑sponsored actors who exploit basic misconfigurations and aged vulnerabilities to achieve strategic objectives. While the immediate focus has been on router weaknesses and Cisco Smart Install, the underlying pattern—leveraging low‑cost, high‑yield tactics to infiltrate critical infrastructure—remains unchanged. Continued collaboration among international cybersecurity agencies, proactive hardening of network devices, and rapid response to detected anomalies are essential to blunt the effectiveness of Centre 16 and similar adversaries in the months and years ahead.