Russian Spies Are Breaking Into the World's Routers. The Password Is Often Still 'Admin'.
A joint advisory from the US, UK, and a dozen allied nations warns that Russian FSB hackers have spent years walking into critical infrastructure networks through the digital equivalent of an unlocked front door.
Key points
- Russia's FSB Centre 16 has been breaking into routers and networking equipment belonging to critical infrastructure organisations across multiple countries, according to a joint advisory published this week by cybersecurity agencies from the US, UK, and twelve allied nations.
- The UK and the EU jointly imposed sanctions on 24 Russian individuals and organisations on the same day, marking the first time the two have acted together on this kind of measure.
- UK and EU officials formally blamed FSB Centre 16 for a January attack on Poland's electricity grid that they say could have cut power to 500,000 people in winter.
- The total number of individuals and entities the UK has sanctioned over Russia's war in Ukraine now stands at 3,400.
- The techniques being used have been publicly known for over a decade, and they keep working because too many organisations ignore the basics.
Russia's Federal Security Service, the FSB, runs a hacking unit known as Centre 16. Researchers also track it as Energetic Bear, Crouching Yeti or Static Tundra. Their target list reads like a directory of things that keep modern life running: power grids, hospitals, banks and defence contractors.
The group's favourite way in is almost embarrassingly simple. They scan the internet for networking devices that still use the password shipped from the factory. Then they log in.
Once inside, they instruct the device to send its configuration file, a document mapping out how the whole network is built, to a server the hackers control. That blueprint lets them plan deeper intrusions.
How did the hackers get in?
The primary method is exploiting a tool called SNMP, or Simple Network Management Protocol, software built into most routers that lets administrators monitor and adjust settings remotely. Hackers scan for devices where SNMP still accepts a default or easily guessed password, then pull the network's configuration data. They've also exploited known security flaws in Cisco Systems hardware and abused a Cisco feature called Smart Install, designed to help set up new devices remotely but dangerous when left switched on unnecessarily.
The fix isn't exotic. Change default passwords. Disable features you're not using. Upgrade SNMP to its latest version, which includes proper encryption.
John Strand, owner of Black Hills Information Security, put it bluntly. Attackers are winning "because too many organizations still struggle with the fundamentals of computer security," he said. Security teams have known about SNMP abuse and Cisco Smart Install misuse for more than a decade.
The advisory arrived alongside sanctions news that Threat Vectr covered the same day in our report on the EU and UK actions: the two jointly sanctioned 24 Russian nationals and organisations for cyberattacks, election interference and disinformation across Europe. Officials singled out an attack on Poland's energy grid in January as "a reckless attack" that could have plunged half a million Poles into darkness mid-winter.
Should you worry?
For ordinary people the risk is to services they depend on. A hacked hospital network can delay patient care. A compromised power-grid operator can mean outages. Anyone who uses organisations in the named sectors should watch for unusual service disruptions and stay alert to phishing emails, where criminals send fake messages to trick staff into handing over passwords, since credentials are often the next thing attackers chase once they're inside.
What this beat keeps teaching is that scale doesn't require sophistication. The most consequential intrusions in this campaign relied on no-one bothering to change a default password. That's not a novel threat. It's an old embarrassment that nation-states have learned to count on.
