8 minhigh
UK and Allies urge critical sectors to improve defences against Russian intelligence targeting
A joint advisory from the UK NCSC and 18 international agencies warns that Russian FSB Centre 16 cyber actors are globally exploiting poorly configured routers and network devices to target critical national infrastructure. The group uses SNMP scanning to find devices with default or weak credentials and exploits known vulnerabilities in Cisco devices and web portals to gain control. The advisory coincides with UK sanctions and formal attribution of a December 2025 attack on Poland's energy grid to the same actor.
Sens:▲ 24h
Detection / Hunteropenrouter
What Happened
The UK government and international partners have issued a warning that Russian intelligence hackers are targeting critical infrastructure organizations around the world by taking advantage of poorly secured internet routers. The hackers, part of a Russian intelligence unit called Centre 16, scan the internet for routers that still use default or easy-to-guess passwords and then use known software flaws to take control of these devices. Sectors at risk include energy, healthcare, financial services, defense, government, and communications. This matters because these attackers have already been linked to a serious attempt to cut power to half a million people in Poland. Organizations should immediately update their router settings, use stronger passwords, disable outdated management protocols, and follow the security recommendations in the published advisory.
Key Takeaways
- FSB Centre 16 (aka Berserk Bear, Energetic Bear, Dragonfly, and others) is opportunistically exploiting poorly configured routers and network devices globally, targeting critical national infrastructure sectors.
- Primary initial access method involves scanning the internet for devices using default or weak SNMP passwords and community strings.
- The actor has also exploited well-known vulnerabilities in Cisco devices, Cisco Smart Install (SMI) feature, and web-portal flaws to gain control of network devices.
- The UK and allies formally attributed a December 2025 attack on Poland's energy grid to FSB Centre 16, which could have caused 500,000 civilians to lose electricity.
- Organizations are urged to implement SNMPv3, disable legacy SNMP versions, enforce strong unique passwords on network devices, and restrict access to management protocols.
Affected Systems
- Poorly configured routers and network devices using default or weak SNMP credentials
- Cisco network devices (including Smart Install feature)
- Network devices with web-portal vulnerabilities
- Critical national infrastructure sectors: communications, defence, energy, financial services, government, healthcare
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Reconnaissance: Actor scans the internet for network devices using default or weak SNMP passwords and community strings
- Initial Access: Vulnerable routers are compromised via weak SNMP credentials or known vulnerabilities in Cisco devices and Smart Install (SMI)
- Persistence/Control: Actor gains control of network devices, potentially leveraging web-portal flaws for further access
- Lateral Movement: Compromised network devices used as footholds to target critical national infrastructure networks
- Impact: Disruption or destructive operations against CNI targets (e.g., attempted energy grid attack on Poland)
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules or queries are provided in this article. The advisory focuses on defensive recommendations and hardening guidance rather than detection logic.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | The primary attack surface is network infrastructure devices (routers, switches) which typically do not run EDR agents. EDR would only provide visibility into post-compromise lateral movement to endpoints. |
| Network Visibility | Medium | SNMP scanning and exploitation of network devices could be detected via network flow analysis, SNMP traffic monitoring, and NIDS signatures for known Cisco exploits, but organizations often lack visibility into management protocol traffic patterns. |
| Detection Difficulty | Hard | Detecting opportunistic SNMP scanning and router exploitation requires network-level telemetry that many organizations do not comprehensively collect or correlate. Distinguishing malicious SNMP activity from legitimate management traffic is challenging without baselining. |
Required Log Sources
- Network device syslog (SNMP access attempts, configuration changes)
- Network flow data for scanning detection
- NIDS alerts for known Cisco/SMI exploit signatures
- Firewall logs for management protocol access (SNMP, SSH, HTTP/HTTPS to device management interfaces)
- SIEM correlation of external scanning sources targeting SNMP ports
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| If you have visibility into network flow data or SNMP traffic logs, consider hunting for external or unexpected source IPs attempting SNMP connections (UDP 161/162) against internal network devices, which may indicate reconnaissance by this threat actor. | Network flow records, SNMP traffic logs, firewall logs | Reconnaissance / Initial Access | Medium — legitimate network management tools and monitoring systems may generate SNMP traffic; requires baselining of authorized SNMP sources. |
| If you collect network device syslog or configuration change logs, consider hunting for unauthorized configuration changes on routers and switches, particularly those following external SNMP access events. | Network device syslog, configuration management logs | Persistence / Control | Low — unauthorized configuration changes on network devices are typically high-fidelity indicators. |
| If you have NIDS or IDS coverage, consider hunting for signatures related to Cisco Smart Install (SMI) exploitation attempts targeting TCP port 4786 on network devices. | NIDS/IDS alerts, network flow data | Initial Access | Low — SMI exploitation attempts from external sources are rarely legitimate. |
| If you have DNS or web proxy logs, consider hunting for access to network device web management portals from unexpected external IP ranges or non-administrative internal subnets. | Web proxy logs, DNS logs, firewall logs | Initial Access | Medium — legitimate remote management access may generate similar traffic patterns; correlate with VPN and admin source baselines. |
Control Gaps
- Network devices (routers, switches) typically lack endpoint detection agents, creating a blind spot for EDR-dependent security stacks.
- SNMP traffic on UDP 161/162 may not be routinely monitored or alerted on by many organizations.
- Legacy SNMP versions (v1/v2c) lack encryption and authentication, making credential interception and brute-force difficult to detect.
- Management protocol access controls on network devices are often permissive or poorly documented, making anomalous access difficult to distinguish from legitimate activity.
Key Behavioral Indicators
- External or unexpected source IPs sending SNMP requests to internal network devices
- Authentication failures or default community string usage (e.g., 'public'/'private') in SNMP logs
- Configuration changes on network devices originating from non-management network segments
- Inbound connections to Cisco Smart Install port (TCP 4786) from external or untrusted sources
- Web portal access to network devices from unexpected geographic regions or IP ranges
False Positive Assessment
Medium — SNMP scanning and management protocol traffic can be generated by legitimate network management and monitoring tools. Distinguishing malicious activity requires baselining authorized management sources and correlating with other indicators such as external source IPs and configuration changes.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider auditing all network devices for default or weak SNMP community strings and credentials, and replace them with strong, unique passwords immediately.
- If supported by your network devices, consider disabling legacy SNMP versions (v1/v2c) and enabling SNMPv3 with authentication and encryption.
- Evaluate whether Cisco Smart Install (SMI) is enabled on any network devices and disable it if not required, as it has been exploited by this threat actor.
- Consider restricting access to device management protocols (SNMP, SSH, HTTP/HTTPS) to specific management VLANs or trusted IP ranges via ACLs.
- If you operate in a CNI sector, consider prioritizing a review of all externally exposed network device management interfaces and closing any unnecessary access paths.
Infrastructure Hardening
- Consider implementing network segmentation to isolate management interfaces of routers and switches from general network traffic.
- Evaluate whether your organization's network devices are running supported firmware versions with known vulnerabilities patched, particularly Cisco devices.
- If feasible, consider deploying a network access control (NAC) solution to enforce authentication and authorization for management access to network infrastructure.
- Consider implementing centralized logging for all network device configuration changes and management access events, forwarding to your SIEM for correlation and alerting.
User Protection
- Consider reviewing and strengthening authentication for all network infrastructure management accounts, enforcing unique credentials per device.
- If your organization supports it, consider implementing multi-factor authentication for remote access to network management systems and jump hosts.
- Evaluate whether network device web portals need to be externally accessible and restrict or disable them where possible.
Security Awareness
- Consider incorporating awareness of router and network device security hygiene into existing training programs for network operations teams.
- If applicable to your organization, consider pursuing Cyber Essentials certification or using the Cyber Assessment Framework to evaluate security maturity.
- Consider briefing relevant stakeholders on the threat from state-sponsored actors targeting critical infrastructure and the importance of network device hardening.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping5 techniques
Tactic
Reconnaissance
Tactic
Initial Access
Tactic
Credential Access
Tactic
