FSB Center 16 exploits router misconfigurations globally

Russian FSB Center 16 actors are opportunistically compromising poorly secured routers worldwide via SNMP abuse and Cisco vulnerabilities to hit critical infrastructure.

A joint advisory from NSA, CISA, FBI, and international partners details ongoing exploitation activity by Russian FSB Center 16 cyber actors, also tracked as Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard, and Static Tundra. The actors primarily scan the internet for networking devices, mainly routers, with active SNMP agents that accept default or common community strings. Using spoofed IP addresses and proxy infrastructure, they issue SNMP Set-Requests with OIDs that instruct devices to copy their configuration files (often named config.bkp or output.txt) and exfiltrate them via TFTP to actor-controlled VPS or compromised FTP servers.

While SNMP misconfiguration abuse is the primary vector, the actors also occasionally exploit known CVEs in Cisco devices, including Cisco Smart Install functionality and device management web portals. This activity has continued for over a decade and targets Communications, Defense Industrial Base, Energy, Financial Services, Government Services (particularly state/local level), and Healthcare and Public Health sectors globally. The advisory notes overlapping TTPs with other threat actors such as Salt Typhoon, suggesting these techniques are broadly applicable beyond this specific actor set.

Mitigations focus on hardening network device configurations: disabling Cisco Smart Install, migrating to SNMPv3 with authPriv encryption, disabling legacy SNMPv1/v2, enforcing strong unique credentials with secure hashing (type 8), restricting SNMP access via MIB allow-lists and ACLs, and blocking unnecessary external access to TFTP, SMI, and SNMP ports. Agencies emphasize that these are largely opportunistic attacks against fundamentally poor device hygiene rather than sophisticated exploitation of novel vulnerabilities.

title: SNMP Set-Request Issued to Network Device
description: Detects SNMP Set-Request PDUs (SNMP writes) targeting network device
  management interfaces. Threat actors abuse default/weak community strings to issue
  Set-Requests instructing devices to copy config files for exfiltration. Generalises
  on protocol behaviour (SNMP write PDU) rather than specific community strings or
  filenames.
tags:
- attack.collection
- attack.t1602.002
- attack.t1602.001
logsource:
  category: network_connection
  product: zeek
  service: snmp
detection:
  selection:
    dest_port: 161
    pdu_type: SetRequest
  filter_known_nms:
    id.orig_h|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  condition: selection and not filter_known_nms
falsepositives:
- Legitimate network management systems (NMS) performing authorized SNMP configuration
  pushes from internal management subnets
- Automated device provisioning tools using SNMP writes for legitimate config changes
level: medium
id: cc59e697-0b23-5028-ad5d-563e2756d23d
status: experimental
author: Vorant

title: Outbound TFTP Write Transfer to External Host
description: Detects a TFTP write-request (WRQ) opcode originating from an internal
  network device toward an external destination address. This matches the FSB Center
  16 pattern of instructing compromised routers to push their configuration file to
  an actor-controlled TFTP/VPS host over UDP/69. Generalises on the TFTP write direction/opcode
  rather than specific filenames like config.bkp or output.txt.
tags:
- attack.exfiltration
- attack.t1048
- attack.t1602.002
logsource:
  category: network_connection
  product: zeek
  service: tftp
detection:
  selection:
    dest_port: 69
    opcode: WRQ
  filter_internal_dest:
    id.resp_h|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  condition: selection and not filter_internal_dest
falsepositives:
- Legitimate internal firmware/config backup jobs that use TFTP to a management server
  (should be internal-only)
- PXE boot or device provisioning systems using TFTP file writes
level: high
id: 9459e74f-302e-5c0c-8dcd-df384078f9f8
status: experimental
author: Vorant

title: Inbound Connection to Cisco Smart Install Port
description: Detects TCP connections to port 4786 (Cisco Smart Install) originating
  from outside the local network. Smart Install is often left enabled and internet-reachable
  on unpatched Cisco devices, and is abused for unauthenticated configuration retrieval
  and code execution. Generalises on the well-known SMI port and external origin rather
  than specific exploit payloads.
tags:
- attack.initial-access
- attack.t1190
- attack.t1068
logsource:
  category: network_connection
  product: zeek
detection:
  selection:
    dest_port: 4786
    proto: tcp
  filter_internal_source:
    id.orig_h|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  condition: selection and not filter_internal_source
falsepositives:
- Internal network operations teams using Smart Install for legitimate zero-touch
  provisioning (should originate from internal management subnets)
- Vulnerability scanners authorized to test for exposed Smart Install services
level: high
id: 8d619686-c24a-5c13-973d-4f4d08fef1d7
status: experimental
author: Vorant

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-194a