Russian FSB Exploits Poor Router Hygiene to Target Critical Infrastructure
Russian FSB-linked actors are actively exploiting routers left in insecure default states — using default SNMP community strings, unpatched CVEs, and exposed Cisco Smart Install interfaces to gain persistent footholds in critical infrastructure networks. The root cause is a failure of configuration management: organizations are deploying network devices without hardening them against well-known attack vectors. This matters because compromised routers give adversaries access to network configuration data, traffic routing, and lateral movement opportunities across entire sectors including energy, finance, and healthcare. The fact that these techniques rely on known, documented vulnerabilities and default credentials means that effective hygiene practices could prevent the majority of these intrusions.
Tactical Insight
Immediate actions
- Disable SNMPv1 and SNMPv2c on all routers and replace with SNMPv3 using strong authentication and AES encryption.
- Audit all internet-facing routers and networking devices for default credentials and change them immediately.
- Disable the Cisco Smart Install feature on all devices where it is not actively required.
Long-term improvements
- Maintain a current, accurate inventory of all network appliances including firmware versions and configuration baselines.
- Establish a formal patch management lifecycle for network infrastructure devices, including OEM end-of-life tracking.
- Implement network segmentation to isolate management plane traffic (SNMP, SSH, Telnet) from general user and production traffic.
Detection measures
- Deploy SNMP monitoring to alert on unusual OID enumeration, bulk SNMP walks, or queries from unexpected source IPs.
- Enable centralized syslog collection from all routers and establish alerting rules for configuration change events.
- Conduct regular vulnerability scans against all network devices using authenticated scanning to surface unpatched CVEs.