NSA Warns Russian State-Sponsored Hackers Exploiting Vulnerable Routers to Target Critical Infrastructure

The U.S. National Security Agency (NSA) and international cybersecurity partners have issued a warning that Russian state-sponsored threat actors are actively exploiting vulnerable and poorly configured network routers to access organizations in critical infrastructure sectors.

In a joint Cybersecurity Advisory (CSA) titled “Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting,” released on July 13, 2026, the agencies attributed this activity to the Russian Federal Security Service’s (FSB) Center 16.

This unit is known for conducting signals intelligence and cyber operations against foreign governments, commercial entities, and infrastructure targets.

NSA Warns Russian State-Sponsored Hackers

According to the advisory, Russian threat actors have targeted networks in the United States and other countries across sectors such as the Defense Industrial Base, communications, energy, financial services, government facilities, and healthcare.

This campaign heavily relies on exploiting internet-exposed networking equipment that is unpatched, misconfigured, or secured with weak administrative credentials.

The advisory warns that routers are often a valuable entry point for attackers because they sit at the network perimeter. Compromised routers can enable persistent access, traffic monitoring, credential theft, lateral movement within the network, and command-and-control communications.

Additionally, compromised network devices may be used as infrastructure for targeting downstream organizations or concealing malicious activities.

Reportedly, Russian operators have misused legacy and insecure network management services, such as Trivial File Transfer Protocol (TFTP), Simple Network Management Protocol (SNMP), and Cisco’s Smart Install functionality.

These services can expose device configuration files, allow unauthorized modifications, or help attackers identify and exploit poorly secured infrastructure.

To counter state-backed intrusions, the CSA urges organizations to implement basic router hardening measures. Key recommendations include:

• Replacing older SNMP deployments with SNMPv3, which supports authentication and encryption.
• Using strong, unique administrator credentials.
• Disabling Cisco Smart Install when it is not necessary for operations.
• Restricting TFTP, SMI, and SNMP traffic at the network firewalls.

Organizations should also promptly upgrade router operating systems, firmware, and software images to address known vulnerabilities. Network defenders are encouraged to maintain an accurate inventory of exposed devices, identify end-of-life equipment, and remove unnecessary management interfaces from internet-facing networks.

This advisory expands on a previous FBI Public Service Announcement issued in 2025, which indicated that Russian government-linked actors were targeting networking devices used by critical infrastructure organizations.

The latest guidance provides further details on the actors’ tactics, techniques, and procedures, emphasizing that many intrusions can be prevented through routine security maintenance.

The Cybersecurity and Infrastructure Security Agency, FBI, Department of Defense Cyber Crime Center, and cybersecurity authorities from Australia, Canada, New Zealand, the United Kingdom, and several European nations co-signed the CSA.

Security teams are advised to review router logs for unauthorized configuration changes, unusual management-plane access, unexpected SNMP queries, and connections involving TFTP or other legacy services.

Organizations should also ensure that remote administration is limited to approved management networks and protected by multi-factor authentication wherever supported.

Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN