Loading story…
The FBI and IC3 warned that cyber actors linked to the Russian Federal Security Service's Center 16 targeted networking devices at U.S. and global organizations, including critical infrastructure operators, by exploiting exposed SNMP services and end-of-life equipment vulnerable to the Cisco Smart Install flaw CVE-2018-0171. Investigators said the actors collected configuration files from thousands of devices associated with U.S. entities and, in some cases, modified device configurations to establish unauthorized access.
The intrusions were tied to activity tracked as Berserk Bear and Dragonfly, continuing a long-running Russian campaign focused on compromising network infrastructure as a foothold into victim environments. After accessing edge devices, the actors reportedly conducted internal reconnaissance and showed interest in industrial control system-related protocols and applications, while U.S. authorities urged organizations to inspect networking devices for configuration changes or malware, review older Cisco infrastructure, and report suspected compromises to the FBI or IC3.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
The United States and 12 partner countries issued a joint cybersecurity advisory warning that Russian state-sponsored hackers tied to FSB Center 16 were compromising critical infrastructure worldwide via poorly configured and vulnerable networking devices. The advisory cited tactics including weak or default passwords, Cisco Smart Install abuse, and exploitation of CVE-2008-4128 and CVE-2018-0171, and said affected sectors included defense, communications, energy, financial services, government, and healthcare.
A cybersecurity information sheet was released with defensive guidance aimed at reducing the risk of SNMP abuse on network devices. The document represents a technical mitigation step related to the broader campaign targeting vulnerable or misconfigured networking infrastructure.
The US State Department announced a $10 million reward for information on Marat Valeryevich Tyukov, Mikhail Mikhailovich Gavrilov, and Pavel Aleksandrovich Akulov, who US authorities accused of conducting cyber operations against critical infrastructure on behalf of Russia's FSB Center 16. The action publicly tied the men to the long-running campaign exploiting Cisco Smart Install flaw CVE-2018-0171 and targeting energy and other critical infrastructure organizations worldwide.
IC3 published a public service announcement about Russian government cyber actors targeting networking devices and critical infrastructure. The notice aligns with the FBI warning on the same activity and serves as a public reporting and awareness action.
The FBI warned that cyber actors attributed to the Russian Federal Security Service's Center 16 were targeting computer networks and critical infrastructure in the United States and globally. The alert said the actors exploited SNMP and end-of-life devices vulnerable to CVE-2018-0171, collected configuration files from thousands of devices tied to U.S. entities, altered some configurations for unauthorized access, and conducted reconnaissance including interest in ICS-related protocols.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
11 references tracked. Mallory keeps watching after this page renders.
waterisac.org
Open sourcesecurityaffairs.com
Open sourcesecurityweek.com
Open sourcecyberscoop.com
Open sourceic3.gov
Open sourcefbi.gov
Open sourcemedia.defense.gov
Open sourceic3.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A joint advisory from cybersecurity agencies in 12 countries warned that Russian state hackers linked to **FSB Center 16** are actively targeting vulnerable routers worldwide, focusing on devices exposed with default or weak SNMP credentials and community strings. The agencies said the actors can abuse SNMP to copy router configurations through OIDs and exfiltrate them over TFTP, while also exploiting older network-device flaws such as `CVE-2018-0171` on Cisco equipment. High-risk sectors identified in the warning include communications, defence, energy, financial services, government, and healthcare, and the activity follows formal UK and EU attribution of cyber-attacks on Poland’s energy infrastructure to the same Russian service. Separate reporting highlighted how compromised SOHO and home-office routers can be used for **DNS hijacking** that bypasses endpoint security and enables credential theft against remote workers. The attack path described combines documented Russian tradecraft, including APT28-linked router compromises, with downstream abuse such as redirecting traffic, harvesting **NTLMv2** hashes, and stealing Microsoft 365 credentials and tokens. Defenders were urged to harden or replace poorly secured routers, move to **SNMPv3**, disable unnecessary exposed services, monitor for unauthorized DNS resolver changes and NXDOMAIN spikes, and factory-reset suspected devices before rotating affected credentials.
Aug 15, 2026
Berserk Bear, also tracked as **Dragonfly**, **Crouching Yeti**, and **IRON LIBERTY**, has been linked by multiple organizations to Russian state-directed operations targeting enterprise and industrial control system environments. Reporting describes a long-running campaign focused on gaining and retaining privileged access inside critical infrastructure networks through spearphishing, drive-by compromises, exploitation of public-facing systems, and supply-chain compromises involving trojanized ICS software installers, followed by credential theft, administrator account creation, remote execution, and lateral movement using tools such as **Mimikatz**, **PsExec**, **PowerShell**, **CrackMapExec**, and **SecretsDump**. The group increasingly shifted from exploit-led intrusions to credential-centric tradecraft, including malicious documents, strategic website compromise, outbound SMB authentication leakage, and WebDAV fallback behavior, then abused valid accounts, VPNs, OWA, RDP, and SMB to persist and move across victim environments. Researchers said the actors targeted technologies including **Citrix**, **Microsoft Exchange**, **Fortinet VPNs**, and **Active Directory**, exploiting vulnerabilities such as `CVE-2019-19781`, `CVE-2020-0688`, `CVE-2018-13379`, and `CVE-2020-1472`, while using compromised legitimate infrastructure to mask communications and quietly preposition access that could support future disruptive or coercive operations against critical infrastructure.
Aug 15, 2026
CISA disclosed that an unnamed U.S. federal civilian agency was breached through Cisco firewall vulnerabilities `CVE-2025-20333` and `CVE-2025-20362`, and investigators later found the **FIRESTARTER** backdoor and **Line Viper** malware on the affected devices. Authorities said the attackers, linked by Cisco Talos and allied agencies to **UAT-4356** and the earlier **ArcaneDoor** activity, maintained persistence on Cisco ASA and Firepower/FTD systems even after patches were applied, regained access months later without re-exploiting the original flaws, and used crafted VPN authentication-related requests to execute code and enable unauthorized VPN sessions that bypassed authentication controls. CISA, the U.K. National Cyber Security Centre, and other partners warned that patching alone may not evict the threat because FIRESTARTER can survive standard reboots and, in some cases, firmware updates if the device was compromised before remediation. The updated federal directive requires agencies to audit Cisco firewall infrastructure and submit memory snapshots, while Cisco and CISA urged stronger recovery steps such as hard reboots and reimaging where compromise is suspected. The disclosure came alongside a broader allied advisory that China-linked groups including **Volt Typhoon** and **Flax Typhoon** are increasingly using large covert proxy networks built from compromised SOHO routers and IoT devices—such as the **Raptor Train** and **KV Botnet** infrastructure—to hide intrusions, support espionage, and blunt traditional IP-based blocking defenses.
Jun 29, 2026