Cyber Centre joins warning on Russian FSB hackers stealing router configurations
The Canadian Centre for Cyber Security joined 18 agencies from the United States and allied countries on July 13 in warning that hackers working for Russia's Federal Security Service are quietly copying configuration files from poorly secured routers in critical sectors.
Router configurations can reveal network layouts, passwords and access rules. The authors say this activity, linked to FSB Center 16, has run for more than a decade and relies on weaknesses many organizations could fix with basic hygiene.
How the attacks work
According to the joint advisory, AA26-194A, the actors scan for network devices running SNMP that accept common or default community strings. Using spoofed addresses sent through proxies, they issue SNMP commands that make a router copy its configuration to a file, then pull that file over TFTP to a leased server or a compromised FTP server.
The actors occasionally exploit old Cisco flaws, including CVE-2018-0171 in Cisco Smart Install and CVE-2008-4128, which affects only end-of-life Cisco devices, as well as exposed web management portals. The advisory builds on an FBI public service announcement from August 2025 about the same FSB activity.
Targeted sectors include communications, the defence industrial base, energy, financial services, government services and health care. Industry names for the activity include Berserk Bear, Energetic Bear, Dragonfly, Ghost Blizzard and Static Tundra, though the agencies note those labels may not match their own tracking exactly.
Who signed
The advisory was authored by the NSA, CISA, the FBI and the Defense Department's Cyber Crime Center, with Five Eyes partners including the Cyber Centre and agencies from the Czech Republic, Denmark, Estonia, Finland, France, Italy, Poland and Sweden. The advisory does not name specific Canadian victims.
What to do
- Disable Cisco Smart Install on all devices.
- Move to SNMPv3 with authentication and encryption, and turn off SNMPv1 and v2.
- Use strong, unique local passwords and Cisco type 8 hashing; avoid types 0, 4 and 7.
- Restrict management protocols to a dedicated management network with access control lists.
- At the edge, block TFTP (UDP 69), Smart Install (TCP 4786) and SNMP ports unless they are required.
- Patch network device firmware and replace end-of-life equipment.
