NSA Advisory: Russian FSB Actors Targeting Network Devices

Executive Summary

On July 13, 2026, the National Security Agency (NSA), CISA, the FBI, and partner agencies from Australia, Canada, New Zealand, and the UK released a joint cybersecurity advisory. The document warns that Russian state-sponsored cyber actors, specifically the FSB Center 16, are actively exploiting poorly configured and unpatched network routers. The threat actor group, also tracked as Berserk Bear and Static Tundra, is targeting critical infrastructure sectors globally. The advisory provides tactical guidance for network defenders to harden their devices and improve router hygiene to defend against these ongoing campaigns.

Threat Overview

The advisory details a persistent and opportunistic campaign by FSB Center 16 to gain access to networks by compromising edge devices. The actors are not targeting specific vulnerabilities as much as they are exploiting common misconfigurations and a lack of basic security hygiene.

• Threat Actor: FSB Center 16 (aliases: Berserk Bear, Static Tundra, Ghost Blizzard).
• Targeted Sectors: Defense Industrial Base, Communications, Energy, Financial Services, Government Facilities, and Healthcare.
• Initial Access Vector: The primary method involves scanning for and exploiting devices with exposed Simple Network Management Protocol (SNMP) services using default or easily guessable community strings.
• Secondary Techniques: Exploitation of known vulnerabilities in network devices, particularly Cisco routers, and abuse of legacy management features like Cisco's Smart Install (SMI) protocol.

Technical Analysis

The actor's methodology is straightforward but effective, relying on the large attack surface presented by internet-facing network equipment.

1. Reconnaissance: The FSB actors conduct broad, indiscriminate scans of IP address ranges, searching for devices responding to SNMP queries on UDP port 161. This allows them to fingerprint device types, versions, and configurations.
2. Exploitation: Upon identifying a vulnerable device, they attempt to access it using default or weak community strings (e.g., public, private). Successful access can provide them with the device's full running configuration, including credentials, VPN settings, and network topology information.
3. Further Exploitation: The attackers also leverage known vulnerabilities, such as those in Cisco's IOS and IOS XE software, and abuse the proprietary Cisco Smart Install protocol, which can be misused to overwrite the device's configuration or firmware.

MITRE ATT&CK Mapping

• T1595.001 - Active Scanning: Scanning IP Blocks: The actors use SNMP scans to identify potential targets.
• T1210 - Exploitation of Remote Services: Gaining access via weak SNMP configurations is a form of remote service exploitation.
• T1190 - Exploit Public-Facing Application: Targeting known vulnerabilities in router firmware falls under this technique.
• T1078.001 - Valid Accounts: Default Accounts: The use of default SNMP community strings is equivalent to using default credentials.
• T1589.002 - Gather Victim Identity Information: Email Addresses: Information gathered from router configurations can be used to craft further attacks.

Impact Assessment

A compromised network router provides a significant strategic advantage to an adversary. Potential impacts include:

• Espionage: The ability to monitor, redirect, or capture all traffic passing through the device, enabling large-scale intelligence gathering.
• Persistence: Routers can be a stealthy foothold within a network, often lacking endpoint detection and response (EDR) agents, making compromise difficult to detect.
• Denial of Service: Attackers can modify routing tables or device configurations to cause network outages.
• Pivot Point: The compromised router can be used to launch attacks against other internal network assets.

Given the targeting of critical infrastructure, a successful, widespread campaign could have serious consequences for national security and public safety.

IOCs — Directly from Articles

No specific file hashes, IP addresses, or domains were provided in the source articles.

Cyber Observables — Hunting Hints

Security teams should consider hunting for the following patterns to identify vulnerable devices or active targeting:

Detection & Response

• Network Baselining: Monitor network traffic patterns to and from edge devices. Anomalous activity, such as large data transfers from a router or connections to suspicious IPs, should be investigated. This is a core tenet of D3-NTA: Network Traffic Analysis.
• Configuration Auditing: Regularly audit router configurations for unauthorized changes, weak passwords, or non-compliant settings. Use automated tools to compare running configurations against a secure baseline.
• Log Monitoring: Centralize and monitor syslog data from all network devices. Create alerts for events such as configuration changes, device reboots, and repeated authentication failures.

Mitigation

The advisory strongly recommends the following router hygiene practices:

1. Secure SNMP: If SNMP is required, use SNMPv3, which provides encryption and authentication. Do not use SNMPv1 or v2, and change all default community strings to strong, unique values.
2. Disable Unused Protocols: Disable legacy or unneeded management protocols, especially Cisco Smart Install (no vstack), and block TFTP at the network edge.
3. Patch Management: Implement a robust patch management program to ensure router firmware and software are kept up to date. This is a direct application of D3-SU: Software Update.
4. Access Control: Use access control lists (ACLs) to restrict management access (SSH, HTTPS, SNMP) to a dedicated management network or specific trusted IP addresses.
5. Strong Passwords: Enforce strong, unique passwords for all accounts on network devices and implement multi-factor authentication where possible.