NSA warns: Russian hackers exploiting routers to hit energy, healthcare, finance sectors

The U.S. National Security Agency (NSA), joined by international cybersecurity partners, has issued a stark warning that Russian state-sponsored threat actors are actively exploiting vulnerable and poorly configured network routers to gain access to organizations across critical infrastructure sectors.

Released on July 13, 2026, the joint Cybersecurity Advisory (CSA) titled “Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting” attributes the campaign to the Russian Federal Security Service’s (FSB) Center 16, a unit long associated with signals intelligence and offensive cyber operations against foreign governments, commercial entities, and infrastructure targets.

According to the advisory, operators linked to Center 16 have targeted networks in the United States and allied countries across sectors that include the Defense Industrial Base, communications, energy, financial services, government facilities, and healthcare.

NSA warns: Russian hackers

The attackers focus on internet-exposed networking equipment that is unpatched, misconfigured, or protected by weak administrative credentials, exploiting the fact that routers and other edge devices sit at the perimeter and, once compromised, provide a high-impact foothold.

Compromised routers can enable persistent remote access, bulk traffic interception, credential harvesting, lateral movement deeper into enterprise networks, and covert command-and-control channels; the CSA also notes that adversaries may use hijacked network devices as infrastructure to attack downstream organizations or to obscure their activities.

The advisory calls out the misuse of legacy and insecure network management services—specifically Trivial File Transfer Protocol (TFTP), Simple Network Management Protocol (SNMP), and Cisco’s Smart Install functionality, as recurring enablers in these intrusions.

These services, when left enabled or exposed, can reveal device configuration files, allow unauthorized configuration changes, or help attackers discover and exploit poorly secured devices.

To blunt these threats, the guidance emphasizes routine but effective router-hardening measures. Key recommendations include migrating from older SNMP versions to SNMPv3 to obtain authentication and encryption, deploying strong unique administrator credentials, and disabling Cisco Smart Install unless it is explicitly required.

The CSA also advises restricting TFTP, SNMP, and similar management traffic at network firewalls, promptly upgrading router operating systems, firmware, and software images to remediate known vulnerabilities, and maintaining an accurate inventory of internet-exposed devices to identify end-of-life equipment that should be removed or segmented.

Network defenders are urged to remove unnecessary management interfaces from internet-facing networks and to limit remote administration to approved management networks protected by multi-factor authentication wherever supported.

The advisory builds on a 2025 FBI Public Service Announcement that first flagged Russian government-linked targeting of networking devices used by critical infrastructure organizations, but provides deeper tactical detail about the actors’ techniques and the specific services they exploit.

Co-signatories on the CSA include the Cybersecurity and Infrastructure Security Agency, the FBI, the Department of Defense Cyber Crime Center, and cyber authorities from Australia, Canada, New Zealand, the United Kingdom, and several European nations, underscoring the multinational concern.

Security teams should immediately review router logs for signs of unauthorized configuration changes, unusual management-plane access, unexpected SNMP queries, or unexplained TFTP connections, and integrate router hygiene into incident response planning and regular penetration testing.

The message from U.S. and allied agencies is clear: many of these intrusions are preventable with disciplined, routine security maintenance, updating firmware, tightening configurations, and removing legacy services can meaningfully reduce the attack surface that sophisticated state-backed actors continue to target.