FSB Centre 16 exploits weak router SNMP globally
Russian FSB unit Centre 16 (aka Berserk Bear/Energetic Bear/Static Tundra) is opportunistically compromising poorly secured routers to target critical infrastructure worldwide.
Sourcencsc.gov.uk — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
NCSC and 18 partner agencies from 12 countries issued a joint advisory detailing tradecraft used by FSB Centre 16, tracked under multiple aliases including Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard and Static Tundra. The group primarily scans the internet for network devices still using default or weak SNMP (v1/v2) credentials and community strings, then leverages that access to compromise routers belonging to organisations in communications, defence, energy, financial services, government and healthcare sectors. In addition to SNMP-based compromise, the actor has exploited known vulnerabilities in Cisco devices, including Cisco's Smart Install feature, and flaws in device web management portals to gain control of network infrastructure.
The advisory coincides with UK sanctions against 24 individuals and entities tied to Russian cyber and hybrid operations, and formal attribution (by the UK and EU) of a December 2025 attack on Poland's energy grid to FSB Centre 16 — an incident that could have caused roughly 500,000 civilians to lose power had it succeeded. This underscores that the router-hunting activity described is not purely opportunistic reconnaissance but feeds a capability with demonstrated intent against energy-sector CNI.
Defenders, particularly in CNI sectors, are urged to migrate to SNMPv3 and disable legacy SNMP versions, enforce strong unique passwords/community strings on network devices, and restrict management-protocol access through ACLs. Organisations are also encouraged to pursue Cyber Essentials certification and use the updated Cyber Assessment Framework to benchmark security maturity against this threat.
Mentioned in this report
Source reporting: https://www.ncsc.gov.uk/news/uk-and-allies-urge-critical-sectors-to-improve-defences-against-russian-intelligence-targeting
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the actors it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs