Russian FSB hackers are quietly hijacking routers at hospitals, power firms and banks, nine countries warn
A joint advisory from the US, UK, Australia and six allies names FSB Centre 16 as the group scanning the internet for routers with weak passwords and old Cisco flaws.
Key points
- Nine countries, led by the US NSA, FBI and CISA, published a joint advisory on Monday naming Russia's FSB Centre 16 as the group behind a long-running router hacking campaign.
- The hackers scan the internet for routers using default or weak SNMP passwords, a network management protocol, then copy the device's configuration file to their own servers.
- Centre 16 has exploited a 2018 Cisco flaw, CVE-2018-0171, against critical infrastructure since November 2021, according to an FBI warning issued in August 2025.
- Targeted sectors include energy, healthcare, financial services, defence, communications and state and local government.
- In a separate December 2025 operation, the FBI cleaned malicious settings from 18,000 home and small-office routers in 120 countries linked to Russian military hackers APT28.
Russia's domestic spy agency has spent years quietly taking over the routers that move traffic around hospitals, power grids and banks. That's the blunt message from a joint advisory published on Monday by cyber agencies in the United States, United Kingdom, Australia, Canada, New Zealand, Estonia, Finland, France and Italy.
The advisory, first reported by BleepingComputer, blames a unit called Centre 16 inside Russia's Federal Security Service, the FSB. Security researchers have tracked the same group under names including Berserk Bear, Energetic Bear, Dragonfly, Crouching Yeti and Static Tundra.
How are the hackers getting in?
They're looking for routers that were never locked down properly. Routers are the boxes that shuffle internet traffic in and out of a building. Many still ship with a default password, or one an administrator set years ago and forgot.
Centre 16 scans huge ranges of internet addresses for routers that respond to SNMP, short for Simple Network Management Protocol, the language network gear uses to report its status. If a router accepts a common or default SNMP password (called a community string), the hackers can talk to it directly. They then issue commands that copy the router's configuration file, containing usernames, password hashes and network layouts, and siphon it out using TFTP, the Trivial File Transfer Protocol, to servers they control.
When SNMP doesn't get them in, they fall back on a known Cisco flaw. That flaw, CVE-2018-0171, sits in a Cisco feature called Smart Install, designed to make setting up new switches easier. An attacker who can reach the feature over the network can run their own code on the device. The FBI warned in August that Centre 16 has been abusing this bug against critical infrastructure since November 2021. Four years of active exploitation of a seven-year-old flaw. We first covered CVE-2018-0171 on 13 July 2026, and the router-hijacking pattern it fits has appeared in our coverage since June, when we reported on malware quietly building reconnaissance infrastructure from thousands of neglected devices.
Which industries are being hit?
The agencies list energy, communications, the defence industrial base, healthcare, financial services and state and local government. In plain terms: the systems ordinary people rely on to keep the lights on, money moving and hospitals running.
The UK's National Cyber Security Centre was direct. Centre 16 "has been seen hunting for vulnerable routers by scanning the internet for devices that still use default or weak" SNMP credentials, the NCSC said, and has also gone after "well-known vulnerabilities relating to Cisco devices" and web portals.
What should network owners do now?
The advisory is unusually specific. Upgrade to SNMPv3, the modern version that encrypts its traffic. Disable Cisco Smart Install if you're not using it. Set strong, unique passwords on every device. Block SNMP and TFTP at the network edge so outside systems can't reach them. Patch firmware. Replace kit the vendor no longer supports.
This warning lands alongside a separate cleanup. In December 2025 the FBI, the US Department of Justice, the Polish government and several private companies dismantled FrostArmada, a campaign run by APT28, a different Russian group tied to military intelligence unit 26165. That crew had infected 18,000 MikroTik and TP-Link routers across 120 countries, altering DNS settings to redirect Microsoft 365 login traffic and steal credentials and OAuth tokens (the digital keys apps use to stay signed in). A court order let the FBI reach into the routers and reverse the damage.
Should you worry about your home router?
If your router is running firmware years out of date, the answer's yes. Change the admin password from whatever the box shipped with. If your internet provider supplied the device, ask when it was last updated. The FSB isn't targeting home users directly, but APT28 already used exactly this class of device as operational infrastructure. Neglected routers don't stay unnoticed.
