A coordinated advisory from the U.S. and allies warns that Russian state-sponsored actors linked to FSB Center 16 continue to compromise poorly secured routers and networking devices to access critical infrastructure worldwide.

U.S. authorities, led by the NSA, warn that these Russian hackers are targeting vulnerable networking devices to breach critical infrastructure on a global scale.

The joint alert notes that home and small-office routers are being compromised to conceal illicit activity against sensitive organizations across multiple sectors.

Guidance stresses stringent router hygiene and proactive cyber defense to mitigate disruptions to critical infrastructure across multiple sectors.

Five priority hardening measures are recommended: use SNMPv3, enforce strong passwords, disable Smart Install, block TFTP/SMI/SNMP at borders, and promptly patch software/firmware.

Edge devices are attractive entry points for attackers due to lighter scrutiny, enabling persistent access and lateral movement into sensitive systems, underscoring the need for basic router hygiene.

Key targets span communications, defense, energy, financial, government, and healthcare sectors, with state and local governments highlighted for critical public services.

The campaign exploits weak configurations, outdated management protocols, and known vulnerabilities rather than zero-days, using edge devices like routers for espionage, credential theft, and persistence.

Mitigation emphasizes disabling Cisco Smart Install, upgrading SNMPv1 to SNMPv3, replacing default passwords with strong unique credentials, and monitoring for unusual SNMP requests and local account activity.

Many compromises arise from long-known weaknesses and insecure configurations, underscoring the need to address fundamental security practices.

Efforts to disrupt botnets include actions by Google and others to shut down large residential proxy networks, with some governments covertly disinfecting routers, though such measures have been limited and reactive.

Defenders are advised to disable Cisco Smart Install on all devices, enforce stronger authentication, and watch for unusual local account credentials and logins.