FSB Centre 16 exploits weak router SNMP globally
Russian FSB unit Centre 16 (aka Berserk Bear/Energetic Bear/Static Tundra) is opportunistically compromising poorly secured routers to target critical infrastructure worldwide.
NCSC and 18 partner agencies from 12 countries issued a joint advisory detailing tradecraft used by FSB Centre 16, tracked under multiple aliases including Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard and Static Tundra. The group primarily scans the internet for network devices still using default or weak SNMP (v1/v2) credentials and community strings, then leverages that access to compromise routers belonging to organisations in communications, defence, energy, financial services, government and healthcare sectors. In addition to SNMP-based compromise, the actor has exploited known vulnerabilities in Cisco devices, including Cisco's Smart Install feature, and flaws in device web management portals to gain control of network infrastructure.
The advisory coincides with UK sanctions against 24 individuals and entities tied to Russian cyber and hybrid operations, and formal attribution (by the UK and EU) of a December 2025 attack on Poland's energy grid to FSB Centre 16 — an incident that could have caused roughly 500,000 civilians to lose power had it succeeded. This underscores that the router-hunting activity described is not purely opportunistic reconnaissance but feeds a capability with demonstrated intent against energy-sector CNI.
Defenders, particularly in CNI sectors, are urged to migrate to SNMPv3 and disable legacy SNMP versions, enforce strong unique passwords/community strings on network devices, and restrict management-protocol access through ACLs. Organisations are also encouraged to pursue Cyber Essentials certification and use the updated Cyber Assessment Framework to benchmark security maturity against this threat.
Mentioned in this report
Detection guidance
SNMP Enumeration via Community String Brute Force
Detection of SNMP v1/v2 queries with multiple distinct community strings to the same target within a short window, indicating credential brute-force or default-credential scanning. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SNMP Enumeration via Community String Brute Force
description: Detects SNMP v1/v2 traffic (UDP 161) with multiple distinct community
strings queried against the same target device, typical of weak-credential scanning
or brute-force discovery of SNMP-accessible network infrastructure.
tags:
- attack.credential-access
- attack.t1110
logsource:
category: network_connection
product: zeek
detection:
selection:
dest_port: 161
proto: udp
snmp_version:
- '1'
- 2c
condition: selection
falsepositives:
- SNMP monitoring tools scanning multiple devices with default community strings during
authorized discovery
- Network management platforms performing routine SNMP enumeration across infrastructure
level: medium
id: fe4e76a6-b3e2-5214-8c49-ec2b0ea8230c
status: experimental
author: Vorant
Network Device Web Management Portal Access via Weak Credentials
HTTP(S) login attempts to common network device management interfaces (Cisco, Juniper, Arista, etc.) with rapid successive failed followed by successful authentication, indicating credential brute-force or default-credential exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Network Device Web Management Portal Access via Weak Credentials
description: Detects repeated HTTP(S) authentication attempts to network device management
interfaces (ports 80, 443, 8080, 8443) with rapid login failures followed by success,
typical of credential brute-force or default-credential exploitation against routers
and switches.
tags:
- attack.initial-access
- attack.t1078
logsource:
category: network_connection
product: zeek
detection:
selection:
dest_port:
- 80
- 443
- 8080
- 8443
proto: tcp
http_method: POST
http_uri|contains:
- /login
- /admin
- /system
- /config
http_status_code:
- '401'
- '403'
condition: selection
falsepositives:
- Network administrators testing access with multiple credential sets during maintenance
windows
- Legitimate network discovery and asset management tools probing device interfaces
level: medium
id: 40f486db-efa6-5913-bde7-6645c7bb8b62
status: experimental
author: Vorant
Cisco Smart Install Feature Exploitation Attempt
TCP connections to Cisco Smart Install service port (4786) with characteristic install/config command traffic patterns, indicating exploitation of known Cisco Smart Install vulnerability (CVE-2018-15379). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cisco Smart Install Feature Exploitation Attempt
description: Detects TCP connections to Cisco Smart Install service port (4786) with
payload patterns consistent with known Smart Install protocol exploitation, typical
of CVE-2018-15379 and related Cisco device compromise techniques.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: network_connection
product: zeek
detection:
selection:
dest_port: 4786
proto: tcp
payload|contains:
- EXEC
- CONFIG
- VERIFY
condition: selection
falsepositives:
- Legitimate Cisco Smart Install image distribution and firmware updates in managed
environments
- Authorized device provisioning and configuration deployment via Smart Install protocol
level: high
id: 992a6268-403f-5604-8495-9ba4f3a1688c
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ncsc.gov.uk/news/uk-and-allies-urge-critical-sectors-to-improve-defences-against-russian-intelligence-targeting
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free