Loading threat actor…
Center 16 is a cyber and signals intelligence unit of Russia’s Federal Security Service (FSB) associated with long-running state-sponsored intrusions against critical infrastructure and government-related targets. It is also tracked under aliases including Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard, and Static Tundra. The actor has been publicly linked to sustained campaigns spanning more than a decade and to attempted cyber sabotage against Poland’s energy sector and water treatment facilities. Center 16 has focused heavily on routers, switches, and other edge networking devices as an initial foothold into victim environments. Its tradecraft includes large-scale internet scanning for exposed infrastructure, especially devices using default, weak, or reused SNMP credentials and poorly secured management services. The actor has abused legacy SNMP configurations to obtain access to network devices, issue commands that copy device configurations, and exfiltrate those configurations for follow-on exploitation. It has also exploited weaknesses in Cisco Smart Install, web-based management portals, and known Cisco vulnerabilities including CVE-2018-0171 and CVE-2008-4128. Compromise of network infrastructure enables Center 16 to harvest credentials and configuration data, monitor traffic, redirect communications, maintain persistence, and pivot deeper into enterprise or operational networks. Reported victim sectors include communications, defense industrial base and military-related organizations, energy, financial services, government facilities and public-sector entities, and healthcare. Activity has affected organizations in the United States and allied countries, with formal public attribution also tying the actor to operations against Poland and broader malicious activity affecting multiple European states. The actor’s behavior is consistent with Russian state espionage and strategic access objectives, with some operations carrying sabotage risk against critical services. Public reporting also identifies sub-elements such as FSB Unit 61240 in connection with Center 16 operations targeting France.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Russian state-backed cyber unit opportunistically targeting poorly secured routers and network devices worldwide, using SNMP scanning, weak/default/reused credentials, outdated protocols, known Cisco vulnerabilities, Cisco Smart Install weaknesses, and web management portal flaws to compromise routers for traffic monitoring, redirection, credential theft, persistence, and deeper network access.
Conducting opportunistic intrusions into critical infrastructure networks worldwide by exploiting weak router credentials, outdated networking technology, Cisco Smart Install, web management portals, and Cisco vulnerabilities. The group was also formally blamed for a failed December 2025 cyberattack against Poland’s energy grid.
FSB-linked operators are conducting ongoing intrusions into critical infrastructure networks worldwide by exploiting weak credentials, outdated networking devices, Cisco Smart Install, web management portals, and Cisco vulnerabilities.
Conducting long-running attacks against critical network infrastructure by scanning for poorly configured network devices, exploiting Cisco Smart Install and network management web portals, and stealing device configurations and credentials.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.