A joint advisory from intelligence and cybersecurity agencies across four continents details how Russia’s FSB Centre 16 is systematically harvesting router configurations from poorly secured networks.
Summary
- FSB Centre 16 actors scan internet-facing routers for SNMP agents using default or common community strings, then exfiltrate device configurations to actor-controlled servers.
- Nineteen agencies across the US, Australia, Canada, New Zealand, the UK, and multiple European nations co-authored the advisory, reflecting the breadth of observed targeting.
- Affected sectors include communications, energy, defence industrial base, financial services, government facilities, and healthcare.
- The same mitigations counter overlapping activity from other threat actors, including Salt Typhoon.
- Key fixes are straightforward: disable Cisco Smart Install, migrate to SNMPv3 with authPriv, block legacy SNMP at the edge, and patch or replace end-of-life devices.
What the advisory describes
A joint advisory issued by nineteen agencies — led by the US NSA, CISA, FBI, and DC3, and co-sealed by ASD’s ACSC, CSE Canada, NCSC New Zealand, NCSC UK, and intelligence and security bodies from the Czech Republic, Denmark, Estonia, Finland, France, Italy, Poland, and Sweden — details sustained exploitation of networking devices by cyber actors attributed to FSB Centre 16, a unit of Russia’s Federal Security Service.
The activity is not new. This advisory builds on an earlier FBI public service announcement covering more than a decade of FSB Centre 16 operations. The same group is tracked across the commercial threat intelligence community under names including Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard, and Static Tundra.
How the attacks work
The primary technique is straightforward. Actors scan internet IP ranges to identify routers running SNMP agents that accept common or default community strings. Scans are routed through proxies and use spoofed source addresses to obscure origin. Once a responsive device is identified, the actors send SNMP Set-Requests containing Object Identifiers that instruct the device to copy its configuration file — typically named “config.bkp” or “output.txt” — and transfer it via TFTP to an actor-controlled virtual private server or compromised FTP server.
That configuration file is the prize. It frequently contains credentials stored with weak or insecure hashing — Cisco Type 0 (plaintext) and Type 7 are specifically called out — giving actors a direct path to subsequent access. Beyond SNMP abuse, the actors have also exploited vulnerabilities in Cisco devices, including CVE-2018-0171 and CVE-2008-4128, as well as Cisco’s Smart Install functionality.
Who is at risk
The advisory identifies seven critical infrastructure sectors as most exposed: communications, defence industrial base, energy, financial services, government services and facilities (with particular note of state and local government), and healthcare and public health. The targeting is described as opportunistic rather than narrowly focused, meaning any organisation running a poorly configured internet-facing router is a viable target regardless of sector.
The overlap with other threats
The authoring agencies note that many of these techniques overlap with activity attributed to other threat actors, specifically naming Salt Typhoon. The mitigations recommended in this advisory are therefore not narrowly defensive against one nation-state — they address a broader class of router exploitation that multiple adversaries are actively conducting.
What the agencies are asking organisations to do
The advisory is prescriptive. It calls for disabling Cisco Smart Install entirely, migrating SNMP deployments to version 3 with the “authPriv” security level, and disabling SNMPv1 and SNMPv2 where possible. Where legacy SNMP versions cannot be immediately removed, organisations are instructed to replace default community strings, restrict access to read-only, and apply access control lists so management protocols are reachable only from designated management devices, preferably on an out-of-band network.
At the firewall perimeter, the agencies recommend blocking UDP port 69 (TFTP), TCP port 4786 (SMI), UDP ports 161 and 162 (SNMP), and TCP/UDP ports 10161 and 10162 (SNMPv3) unless there is a specific operational need — and monitoring closely where blocking is not immediately feasible. Password storage on Cisco devices should use hashing type 8; types 0, 4, and 7 should be avoided.
Detection guidance includes monitoring SNMP logs for Set-Requests targeting specific OIDs — the advisory names Cisco Config Copy OID 1.3.6.1.4.1.9.9.96.1.1 as an example — and alerting on logins using local device accounts, which should ordinarily only be used when centralised authentication is unavailable. Organisations are also encouraged to deploy an attack surface management service to identify exposed and misconfigured devices.
Why it matters
For CISOs, the core risk here is not exotic malware or zero-days — it is the mundane failure to harden network infrastructure that has been in scope for years. An SNMP default community string on a perimeter router is sufficient for actors to silently exfiltrate the device configuration and obtain credentials. That configuration file becomes the entry point into the broader environment. The breadth of co-signatories signals that this threat has been observed across multiple allied nations’ networks simultaneously. Organisations running legacy SNMP versions on internet-accessible devices, or that have not audited password hashing types on Cisco infrastructure, should treat this advisory as an immediate prompt to act.
What to do now
- Audit all internet-facing and management-network routers for SNMP version — disable SNMPv1 and SNMPv2 where feasible and migrate to SNMPv3 with authPriv.
- Replace any default or common SNMP community strings immediately; if legacy SNMP versions must remain, restrict to read-only access and apply ACLs limiting SNMP to management devices only.
- Disable Cisco Smart Install on all Cisco devices.
- Review Cisco device configurations for password hashing types; move to type 8 and remediate any type 0, 4, or 7 credentials.
- Block UDP 69, TCP 4786, UDP 161/162, and TCP/UDP 10161/10162 at edge firewalls unless operationally required; apply strict monitoring where blocking cannot occur immediately.
- Write IDS rules to alert on inbound SNMP Set-Requests targeting sensitive OIDs, including the Cisco Config Copy OID (1.3.6.1.4.1.9.9.96.1.1).
- Patch known CVEs on Cisco and other network devices; plan replacement of any end-of-life devices that cannot receive security updates.
- Enable alerts for local account logins on network devices and ensure centralised authentication with MFA is in use for all normal management access.
- Deploy or engage an attack surface management service to maintain visibility over internet-exposed network infrastructure.
- Australian organisations can report incidents and access support via cyber.gov.au or 1300 CYBER 1.
