US and Allies Warn of Russian FSB Router Exploits

The Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency, and the FBI, alongside 19 federal agencies from the UK, Australia, Canada, New Zealand, and Europe, issued a joint cybersecurity advisory on July 13, 2026. The warning states that the Russian Federal Security Service (FSB) Center 16—also known as Military Unit 71330 and tracked as Berserk Bear, Ghost Blizzard, or Dragonfly—is mass-compromising home and small office routers globally.

Center 16 exploits poorly configured devices using the Simple Network Management Protocol (SNMP). By scanning for devices using outdated SNMPv1 or SNMPv2 protocols and default credentials, the actors steal configuration files to build proxy networks that obscure attacks against critical infrastructure. The advisory specifically highlights vulnerabilities in Cisco devices and the Cisco Smart Install tool, citing CVE-2018-0171 and CVE-2008-4128. Targeted sectors include energy, healthcare, finance, communications, and government facilities.

Security agencies urge organizations to upgrade to SNMPv3, disable legacy protocols, retire end-of-life hardware, and block specific protocols at the firewall. On Monday, July 14, the European Union and the United Kingdom expanded their response by imposing asset freezes and travel bans on nine individuals and four entities linked to Center 16's activities. Chris Butera of CISA characterized the advisory as an urgent reminder for critical infrastructure operators to reduce their attack surface against Russian state-sponsored threats.