Cybersecurity agencies from twelve nations have heightened concerns over a sophisticated cyber threat posed by a Russian state-sponsored unit. This advisory warns that the Russian Federal Security Service (FSB) Cyber Unit known as Center 16 is actively engaging in cyberattacks aimed at exploiting vulnerable routers on a global scale.
In a detailed joint advisory, representatives from several cybersecurity agencies outlined the tactics employed by Center 16. Analysts revealed that the unit has been scanning the internet for routers that either still utilize default passwords or exhibit weak security measures associated with the Simple Network Management Protocol (SNMP). These vulnerabilities serve as entry points for potential attackers seeking to compromise network devices.
Center 16, which is often referred to by multiple aliases—including Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard, and Static Tundra—has become notorious for its sophisticated cyber-espionage techniques. The organizations most susceptible to these targeted attacks span vital sectors such as communications, defense, energy, financial services, government, and healthcare. In light of this, the advisory urges these sectors to bolster their cybersecurity protocols.
One recommended measure includes transitioning to SNMP version 3, which boasts integrated authentication and encryption features designed to safeguard management traffic from interception. In contrast, its predecessors—SNMPv1 and SNMPv2—transmit community strings in plaintext, rendering them particularly vulnerable to network sniffing. Should an attacker successfully acquire a valid community string, they could execute commands via Object Identifiers (OIDs) to instruct the router to replicate its configurations and transmit these data files using Trivial File Transfer Protocol (TFTP). Post-exfiltration, these files are often directed to either a virtual private server controlled by the threat actor or an infiltrated file transfer protocol server.
In addition to actively scanning for routers with weak SNMP passwords, Center 16 has demonstrated a pattern of exploiting known vulnerabilities within Cisco devices. For instance, a significant warning was issued by Cisco back in 2025 regarding a vulnerability—designated as CVE-2018-0171—in the Smart Install feature of unpatched and often outdated Cisco devices. Center 16, associated with exploiting this vulnerability, prompted Cisco to urge its customers to implement the corresponding patch released in 2018 or to disable the Smart Install feature if immediate patching was unfeasible.
The advisory further elucidated that many tactics, techniques, and procedures (TTPs) utilized by Center 16 exhibit similarities with those employed by other cyber threat groups, including the China-linked entity Slat Typhoon. This overlap raises concerns within the broader cybersecurity community regarding the collaborative and mimetic nature of cyber threats.
The urgency of the situation is underscored not just by the advisory but also by real-world implications. Concurrently with the issuance of their joint advisory, the UK and European Union (EU) publicly attributed coordinated cyberattacks that took place in late 2025—targeting Poland’s energy infrastructure—to FSB Center 16. In a statement released on July 13, the UK government described this attack as “reckless,” noting that had it succeeded, it would have led to mass electricity outages impacting approximately 500,000 citizens during the harsh winter months. This incident exemplifies the potential for chaos that such state-sponsored attacks threaten to unleash across Europe.
In response to this threat landscape, the UK and EU have introduced a comprehensive joint sanctions package targeting twenty-four individuals and entities implicated in the destructive cyber and hybrid operations. This includes measures against cybercriminals linked to proxy networks associated with Russian Intelligence Services.
Moreover, the UK government has extended its sanctions to individuals involved in a notorious malware tool known as Lumma Stealer. This malicious software has reportedly been used by Russian state actors to gather stolen credentials for cyber espionage operations targeting various global entities, thereby further advancing Kremlin objectives. According to the National Crime Agency, within a six-month period alone, at least 2,100 victims of Lumma Stealer have been identified within the UK.
As nations step up their cybersecurity defenses, the evolving nature of these threats remains a focal point for international collaboration. The stakes are high, as failure to address these vulnerabilities could lead to severe repercussions across critical infrastructure sectors globally.