FSB Center 16 exploits router misconfigurations globally
Russian FSB Center 16 actors are opportunistically compromising poorly secured routers worldwide via SNMP abuse and Cisco vulnerabilities to hit critical infrastructure.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2008-4128 as exploited in the wild.
A joint advisory from NSA, CISA, FBI, and international partners details ongoing exploitation activity by Russian FSB Center 16 cyber actors, also tracked as Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard, and Static Tundra. The actors primarily scan the internet for networking devices, mainly routers, with active SNMP agents that accept default or common community strings. Using spoofed IP addresses and proxy infrastructure, they issue SNMP Set-Requests with OIDs that instruct devices to copy their configuration files (often named config.bkp or output.txt) and exfiltrate them via TFTP to actor-controlled VPS or compromised FTP servers.
While SNMP misconfiguration abuse is the primary vector, the actors also occasionally exploit known CVEs in Cisco devices, including Cisco Smart Install functionality and device management web portals. This activity has continued for over a decade and targets Communications, Defense Industrial Base, Energy, Financial Services, Government Services (particularly state/local level), and Healthcare and Public Health sectors globally. The advisory notes overlapping TTPs with other threat actors such as Salt Typhoon, suggesting these techniques are broadly applicable beyond this specific actor set.
Mitigations focus on hardening network device configurations: disabling Cisco Smart Install, migrating to SNMPv3 with authPriv encryption, disabling legacy SNMPv1/v2, enforcing strong unique credentials with secure hashing (type 8), restricting SNMP access via MIB allow-lists and ACLs, and blocking unnecessary external access to TFTP, SMI, and SNMP ports. Agencies emphasize that these are largely opportunistic attacks against fundamentally poor device hygiene rather than sophisticated exploitation of novel vulnerabilities.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-194a
Free public brief. The indicators are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators and live profiles of the CVEs and actors it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs