Why Routers Have Become the Frontline of State Cyber Warfare

Modern industrial operations and public utilities run on a delicate web of internet-facing hardware, where even a minor configuration oversight can open the door to geopolitical adversaries. A newly issued global warning underscores how state-sponsored cyber actors are systematically hunting down these soft targets to compromise critical infrastructure. By focusing on the humble router, international intelligence agencies are warning that the very gateways of our digital networks are being turned against us.

A Multi-Nation Shield Against Center 16

In a coordinated show of defensive solidarity, cybersecurity agencies from the United States and eight other allied nations—including Australia, the United Kingdom, Canada, New Zealand, Estonia, Finland, France, and Italy—have sounded the alarm on an active espionage campaign. This joint advisory, co-authored by the NSA, the FBI, and CISA alongside 15 other international partner agencies, attributes this sweeping activity to a specific arm of the Russian Federal Security Service (FSB) known as Center 16.

This state-backed threat group, which security analysts also track under monikers like Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard, and Static Tundra, operates by quietly scanning massive ranges of internet IP addresses. They are searching for network routers configured with weak or default Simple Network Management Protocol (SNMP) authentication strings. By issuing commands using spoofed IP addresses, the hackers copy device configuration files and exfiltrate them via the Trivial File Transfer Protocol (TFTP) to actor-controlled servers, giving them a roadmap of target networks.

Exploiting Legacy Flaws in Critical Sectors

The reach of this campaign spans virtually every cornerstone of modern society, targeting organizations in energy, communications, defense industrial base, healthcare, financial services, defense, and state and local government services. Rather than relying entirely on sophisticated zero-day exploits, these Russian state hackers frequently leverage well-known, unpatched vulnerabilities that administrators have neglected for years.

For instance, the FBI warned in August 2025 that this identical threat group has been exploiting a critical vulnerability in the Smart Install feature of Cisco IOS and Cisco IOS XE software, tracked as CVE-2018-0171, since November 2021. The UK National Cyber Security Centre warned on Monday that "Centre 16 [..] has been seen hunting for vulnerable routers by scanning the internet for devices that still use default or weak Simple Network Management Protocol (SNMP) passwords and community strings," and detailed the attackers' approach:

"Whilst the actor primarily uses SNMP scans to locate and compromise vulnerable routers, they have also exploited well-known vulnerabilities relating to Cisco devices, Cisco's Smart Install (SMI) feature and web-portal flaws to gain control of network devices."

The Shadow of Operation FrostArmada

This latest alert is not an isolated incident but part of a broader, aggressive trend of state-sponsored router exploitation. Only recently, an international law enforcement operation successfully disrupted FrostArmada, a separate campaign run by APT28—a Russian military intelligence group linked to GRU unit 26165, also tracked as Fancy Bear and Forest Blizzard.

The scale of these network compromises is laid bare by recent metrics collected by international defenders:

• 18,000 routers compromised globally during the campaign before the intervention.
• 120 countries affected by the rogue DNS redirection scheme.
• December 2025 marked the milestone by which these extensive infections were documented.

In that campaign, the attackers targeted MikroTik and TP-Link small office/home office (SOHO) routers, altering their DNS settings to harvest Microsoft 365 logins and OAuth tokens. It required a court-authorized operation involving the U.S. Department of Justice, the Polish government, and private security firms to remotely scrub the malicious settings and force the compromised devices to connect to legitimate DNS resolvers.

Defending the Edge of the Network

For modern enterprises and public sector IT leaders, the implications of these ongoing campaigns are profound. The edge router is no longer just a passive utility; it is a primary target of foreign intelligence agencies seeking persistent access to national infrastructure. Organizations must shift from a posture of passive maintenance to active boundary defense, treating every connected gateway as a potential bridgehead for adversaries.

To counter this threat, administrators must immediately adopt the mitigation steps recommended by the FBI and its international partners. This includes upgrading legacy protocols to SNMPv3, completely disabling the Cisco Smart Install feature, enforcing robust, unique passwords, and strictly blocking TFTP and SNMP traffic at edge firewalls. Ultimately, defending critical infrastructure requires a relentless commitment to basic network hygiene—because if you do not scan and secure your perimeter, state-backed actors certainly will.