US and allies warn of Russian hackers exploiting router SNMP

Cybersecurity agencies from the United States and allied nations issued a joint advisory on Monday, July 13, 2026, warning that Russian state-backed hackers are actively compromising poorly secured routers worldwide to disguise attacks against critical infrastructure. The advisory, co-signed by agencies from at least 12 countries, urges organizations to immediately improve their network device security.

The activity is attributed to cyber actors from Russia’s Federal Security Service (FSB), specifically tracked as Centre 16. The group is known by various aliases, including Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard, and Static Tundra. According to the advisory, these actors are opportunistically scanning the internet for routers and other networking devices with exposed Simple Network Management Protocol (SNMP) services that still accept default or weak passwords.

Once a vulnerable device is located and compromised, the hackers use it as an exit node, or proxy, to funnel malicious traffic. This technique allows them to probe or attack targets in critical sectors-including communications, defense, energy, financial services, government, and...