In a joint advisory published this summer, nearly 20 government cybersecurity and intelligence agencies from the United States and partner nations named a familiar piece of hardware as the entry point for one of Russia’s most persistent hacking operations: the ordinary router sitting in homes, offices, and utility closets. The advisory ties the campaign to a unit inside Russia’s Federal Security Service, tracked under names including Turla and Secret Blizzard, and describes years of scanning the open internet for poorly secured networking equipment rather than breaking through custom-built defenses. The technical details are dense, but the underlying message is simple: a large share of the exposure traces back to default settings nobody bothered to change.
The Advisory and Who Signed It
The joint Cybersecurity Advisory, AA26-194A, was published July 13, 2026, by the Cybersecurity and Infrastructure Security Agency together with the National Security Agency, the FBI, the Department of Defense Cyber Crime Center, and partner agencies from roughly a dozen countries — close to 20 signatories in total. It attributes the activity to a threat cluster associated with the FSB’s Center 16, also known as Military Unit 71330, and tracked across the cybersecurity industry under aliases such as Turla, Dragonfly, Berserk Bear, and Secret Blizzard. The advisory names communications providers, the defense industrial base, energy companies, financial services firms, government facilities, and healthcare organizations as the sectors most exposed, though the underlying technique works against any organization or household running unpatched, misconfigured networking gear.
SNMP: The Digital Equivalent of a Key Left Under the Doormat
Much of the campaign relies on the Simple Network Management Protocol, a decades-old system administrators use to monitor and configure network devices remotely. Access is gated by a shared password called a community string, and huge numbers of devices still ship, or get configured, with the factory defaults of public and private left in place. Once those strings are exposed, an outsider can often pull a device’s full configuration file, harvest embedded credentials, and quietly map a network without ever needing to guess a password. Federal guidance on this exact weakness dates back years: an earlier CISA alert on reducing the risk of SNMP abuse already recommended moving to the encrypted SNMPv3 standard, retiring default community strings, and restricting management access with access-control lists — the same fixes the 2026 advisory repeats because so many networks never adopted them.
A Second Door: A Legacy Cisco Feature
The advisory also flags continued abuse of Smart Install, a Cisco feature designed to let new switches configure themselves automatically on first boot without a password. The convenience comes at a cost: Smart Install was built with no authentication at all, and it shipped enabled by default on client switches for years. Cisco has published its own guidance on securing the feature, recommending administrators disable it entirely with a single configuration command once initial setup is complete, or restrict access to the management port with an access list if the feature must stay active. Years after that guidance first went out, enough devices still run Smart Install unprotected that state-linked hackers keep returning to it.
Why Routers Instead of Something Flashier
Targeting routers and switches instead of the servers and applications that usually dominate headlines reflects a deliberate strategy. Networking equipment sits at the edge of a network, is frequently overlooked in patch cycles that prioritize desktops and servers, and often runs for years without a reboot or firmware update. A compromised router also gives an intruder a durable vantage point: traffic passing through it can be observed or redirected, and the device itself can be repurposed as a hop point to launch further intrusions while making the true origin of an attack harder to trace. For a state-sponsored unit focused on long-term access rather than a quick smash-and-grab, an unglamorous but persistent foothold in network infrastructure is often more valuable than a single dramatic breach.
The threat cluster behind the campaign is not new to researchers, even if this scale of coordinated public attribution is unusual. Activity linked to FSB Center 16 has been tracked under the alias Turla for more than a decade, with a documented history that includes long-running espionage campaigns against government and military networks in Europe and the United States. The decision by roughly 20 agencies across a dozen countries to co-sign a single advisory reflects both the scale of the router-targeting campaign and a broader shift toward coordinated, public attribution as a deterrent, rather than the quieter, classified handling such findings often received in the past.
What Owners and Network Administrators Are Told to Do
The advisory’s recommendations track closely with the older SNMP and Smart Install guidance: replace default and shared passwords with unique, complex credentials; disable SNMP entirely on devices that do not need it, or upgrade to SNMPv3 with encryption where it is required; disable legacy zero-touch deployment features once a device is set up; keep router and switch firmware current; and segment sensitive systems away from general-purpose networks so a single compromised device cannot easily become a path to everything else. None of it is new advice, which is itself part of the story the advisory tells — the same fixes have been available for years, and the gap between publishing guidance and organizations acting on it is exactly what a patient, well-resourced intelligence unit is built to exploit.
This article was produced with the assistance of AI and reviewed by Morning Overview editors.
More from Morning Overview
