Loading story…
A joint advisory from cybersecurity agencies in 12 countries warned that Russian state hackers linked to FSB Center 16 are actively targeting vulnerable routers worldwide, focusing on devices exposed with default or weak SNMP credentials and community strings. The agencies said the actors can abuse SNMP to copy router configurations through OIDs and exfiltrate them over TFTP, while also exploiting older network-device flaws such as CVE-2018-0171 on Cisco equipment. High-risk sectors identified in the warning include communications, defence, energy, financial services, government, and healthcare, and the activity follows formal UK and EU attribution of cyber-attacks on Poland’s energy infrastructure to the same Russian service.
Separate reporting highlighted how compromised SOHO and home-office routers can be used for DNS hijacking that bypasses endpoint security and enables credential theft against remote workers. The attack path described combines documented Russian tradecraft, including APT28-linked router compromises, with downstream abuse such as redirecting traffic, harvesting NTLMv2 hashes, and stealing Microsoft 365 credentials and tokens. Defenders were urged to harden or replace poorly secured routers, move to SNMPv3, disable unnecessary exposed services, monitor for unauthorized DNS resolver changes and NXDOMAIN spikes, and factory-reset suspected devices before rotating affected credentials.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
10 events from the most recent confirmed update back to the earliest known activity.
The UK NCSC issued a July 2026 advisory titled "UK and Allies urge critical sectors to improve defences against Russian intelligence targeting." It urged critical sectors to strengthen defenses against Russian targeting of poorly configured routers.
The UK and EU formally attributed coordinated late-2025 cyber-attacks on Poland’s energy infrastructure to Russian FSB Center 16. The UK said the attack failed but could have caused 500,000 citizens to lose electricity during winter.
Cisco warned in 2025 that FSB Center 16, also tracked as Static Tundra, was exploiting CVE-2018-0171 in unpatched Cisco devices using Smart Install. Cisco urged customers to patch or disable Smart Install where patching was not possible.
CISA added CVE-2023-23397, a critical Microsoft Outlook vulnerability, to its Known Exploited Vulnerabilities catalog. The reference notes APT28 has been documented exploiting this flaw.
DHS, the FBI, and the UK NCSC issued a joint alert describing a worldwide campaign by Russian state-sponsored actors targeting routers, switches, firewalls, and NIDS devices. The alert said the actors abused weak or legacy protocols including SNMP, Telnet, and Cisco Smart Install to steal configurations, harvest credentials, create GRE tunnels, and conduct man-in-the-middle operations.
Cisco first issued a patch for CVE-2018-0171, a vulnerability affecting devices using the Smart Install feature. Later reporting noted the flaw continued to affect unpatched and often end-of-life Cisco devices.
The FBI conducted operations to neutralize botnets based on Ubiquiti EdgeRouter devices used by APT28. The reference cites this as documented activity relevant to SOHO-router compromise tradecraft.
Cybersecurity agencies from 12 countries issued a joint advisory warning that Russian FSB Center 16 was actively targeting vulnerable routers worldwide. The advisory said the actors scan for routers using default or weak SNMP passwords and community strings and can steal configurations for exfiltration over TFTP.
The UK sanctioned individuals behind Lumma Stealer, saying Russia had used credentials stolen by the malware to support cyber espionage operations globally. The article also cites the UK National Crime Agency as reporting at least 2,100 Lumma victims in the UK within the previous six months.
Alongside the attribution of the Poland energy attacks, the EU and UK announced a joint sanctions package targeting 24 individuals and entities linked to destructive cyber and hybrid operations. The package also included action against cybercriminals involved in proxy networks tied to Russian intelligence services.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
codeby.net
Open sourceeclypsium.com
Open sourceinfosecurity-magazine.com
Open sourcensa.gov
Open sourceus-cert.cisa.gov
Open sourcecisa.gov
Open sourcetools.cisco.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Authorities and private-sector partners disrupted an **APT28** campaign known as **FrostArmada** that hijacked DNS traffic on compromised SOHO routers to steal Microsoft 365 credentials and OAuth tokens. Investigators said the operation abused **MikroTik**, **TP-Link**, some **Nethesis**, and older **Fortinet** devices, redirecting authentication traffic through attacker-controlled VPS infrastructure to perform adversary-in-the-middle interception. Microsoft and Lumen Black Lotus Labs traced the activity, identified victims, and supported action by the **FBI**, the **U.S. Department of Justice**, and Polish authorities to take malicious infrastructure offline. At its peak in December 2025, the campaign had infected about **18,000 devices in 120 countries** and affected government agencies, law enforcement, IT and hosting providers, and organizations running their own servers. The disruption comes amid broader warnings that Russia-linked **Fancy Bear**—also tracked as **APT28**, **Forest Blizzard**, and **Pawn Storm**—continues global cyber-espionage and disruptive operations. Recent reporting tied the group not only to router-based DNS hijacking, including abuse of TP-Link devices and exploitation of **`CVE-2023-50224`**, but also to **NTLMv2** hash relay attacks leveraging Outlook flaw **`CVE-2023-23397`** and malware activity targeting Ukraine’s defense supply chain and allied countries. Security guidance from Microsoft, the UK NCSC, researchers, and government agencies urged organizations to harden routers, patch internet-facing systems, enable MFA, reduce external exposure, remove end-of-life equipment, and adopt certificate pinning and zero-trust controls to limit credential theft and follow-on compromise.
Jun 29, 2026
A **GRU-linked espionage campaign** attributed to **Forest Blizzard** is targeting small office and home office (SOHO) routers by changing DNS settings on poorly protected devices. The altered DNS redirects users trying to reach legitimate services to adversary-in-the-middle infrastructure, where victims are presented with fake login pages that capture **credentials** and **session tokens** before silently forwarding them to the real destination. The activity poses a particular risk to **remote workers** because it abuses unmanaged home-network infrastructure rather than compromising corporate endpoints directly, allowing attackers to intercept identity and business traffic from outside traditional enterprise defenses. Reported mitigations include enforcing **MFA**, routing traffic through **VPNs**, using centralized and monitored DNS, applying traffic filtering, and improving hardening, management, and monitoring of routers and other edge devices.
Jul 16, 2026
The FBI disrupted an **APT28** operation that compromised internet-connected routers to enable **DNS hijacking**, according to reporting citing U.S. and UK government findings. The campaign abused vulnerable edge devices to alter DNS settings and redirect traffic, giving the Russian state-linked group a way to intercept victim communications, harvest credentials, and support follow-on espionage activity. The activity was significant enough to prompt public warnings from the FBI and the UK **NCSC**, which described router exploitation as a key enabler for the hijacking operations. Government guidance tied the operation to exploitation of routers exposed to the internet and urged organizations to harden perimeter infrastructure by patching devices, restricting remote administration, rotating credentials, and reviewing DNS configurations for unauthorized changes. The disclosures underscore how Russian espionage actors continue to rely on stealthy network-level tradecraft—using compromised infrastructure rather than malware alone—to persist in victim environments and covertly redirect or monitor traffic.
Jun 29, 2026