FSB Center 16 targets routers: joint warning from NSA, CISA and Poland's SKW

The NSA, CISA, FBI and international partners have issued a joint warning about Russian operations targeting network devices. According to the advisory, FSB Center 16 continues to exploit vulnerable and poorly configured routers to gain access to networks across energy, communications, financial services, government, healthcare and the defence industrial base.

Poland’s Military Counterintelligence Service (SKW) is among the co-sealing agencies. That is a relevant signal for European organisations: this is not merely a remote campaign against US targets. Edge devices form a global attack surface, yet their configuration and telemetry are often less mature than those of servers and workstations.

Why routers are attractive targets

A router sits where traffic moves between networks, while often being managed by a small team and lacking endpoint-style monitoring. Compromise may let an adversary observe traffic, alter routes, reach administrative interfaces, conceal attacker infrastructure or conduct further operations from the IP address of a trusted organisation.

The advisory also demonstrates that a state actor does not always need a new zero-day. The opening may be:

• a default or shared password;
• outdated firmware;
• unnecessary management protocols reachable from the wrong network;
• Cisco Smart Install left enabled;
• legacy SNMP and overly broad firewall rules;
• local-only logs that make configuration changes hard to detect.

The lesson is straightforward: sophisticated operators can achieve strategic objectives through basic control failures. An advanced adversary does not make every technique advanced.

Five measures highlighted by the advisory

NSA identifies a concise baseline that should be treated as a minimum:

1. Implement SNMPv3 instead of legacy versions, with appropriate authentication and encryption.
2. Use strong, unique passwords per device and eliminate shared administrative accounts.
3. Disable Cisco Smart Install unless there is a documented operational requirement.
4. Block TFTP, SMI and SNMP at the firewall except on tightly defined management paths.
5. Upgrade software and firmware, prioritising devices reachable from the Internet.

This list should not become a paper checklist. Teams must demonstrate that the controls apply to every device, preserve critical connectivity and do not leave an alternative management interface exposed.

How to validate the environment, not just the policy

Measure exposure

Build an inventory of public addresses, devices, models, firmware versions and listening services. Include branch routers, backup circuits, jointly managed carrier equipment and hardware left behind after migrations. Reconcile the CMDB with passive observation and authorised scanning.

Inspect the management plane

Administrative access should be separated from user traffic and restricted to controlled sources. Review ACLs, jump hosts, MFA where supported and individual least-privilege accounts. A console that is “temporarily” reachable from the Internet is still an attack surface.

Compare configuration with a trusted baseline

Look for new accounts, changed DNS or NTP servers, unexpected routes, tunnels, forwarding rules, ACL modifications and newly enabled services. A current configuration export alone is not enough; teams need an approved baseline and a change history.

Move logs off the appliance

An attacker with administrative privileges may remove local evidence. Forward authentication, configuration-change and system logs to a protected central repository. Alert on unexpected reboots, loss of telemetry and abrupt changes in log volume as well as explicit security events.

Prepare for a clean rebuild

Where device integrity is uncertain, installing current firmware may not be sufficient evidence of safety. Maintain a procedure to rebuild from a trusted image and verified configuration, rotate credentials and inspect systems the router could reach.

Signals that require investigation

One event may not prove compromise, but each of the following needs an explanation:

• administrative access from a new location or outside a change window;
• a new local account or altered authentication method;
• TFTP, SMI, Telnet or legacy SNMP being enabled;
• modified routes, tunnels, DNS servers or NAT rules;
• configuration export without a linked request;
• missing logs, an unplanned reboot or a firmware downgrade;
• outbound connections from the device to unknown Internet hosts.

Extend analysis to neighbouring devices and management systems. A compromised router may be both the target and relay infrastructure for later operations.

The practical conclusion

“Router hygiene” sounds basic, but it is part of defending against a state actor. Treat network appliances as privileged systems: apply controlled changes, individual identities, central logging, timely updates and a rehearsed rebuild process.

An IT security audit should validate actual services, management paths, segmentation and configuration resilience on every edge device — not merely confirm that a policy exists.

Primary sources: NSA — Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting, joint Cybersecurity Advisory.