Cybersecurity agencies from the United Kingdom, the United States, Australia, Canada, and several allied nations have issued a joint warning about an ongoing Russian cyber campaign targeting critical infrastructure organizations worldwide.
New reporting from Cybersecurity News highlights that the activity has been attributed to Russian Federal Security Service (FSB) Center 16, also tracked under names such as Berserk Bear, Dragonfly, Crouching Yeti, Energetic Bear, Ghost Blizzard, and Static Tundra. According to the advisory, the attackers are compromising poorly secured networking devices to gain long-term access into critical infrastructure environments.
Rather than exploiting sophisticated zero-day vulnerabilities, the campaign focuses on taking advantage of weak security practices that still exist across many enterprise and operational networks.
According to the advisory, the attackers begin by scanning internet-facing infrastructure for vulnerable networking devices.
Their primary targets include routers and network appliances that:
Instead of attacking endpoints directly, the attackers first compromise the network infrastructure that connects them.
Once access is obtained, the attackers retrieve router configuration files containing valuable network information.
The advisory explains that these configuration files may contain:
This intelligence helps attackers better understand the victim’s environment before moving deeper into the network.
Why Routers Have Become Prime Targets
Routers rarely receive the same attention as endpoints or servers, yet they occupy one of the most privileged positions inside an enterprise network.
Compromising a router allows attackers to:
Because networking devices often operate continuously for years with limited monitoring, they can become ideal persistence points for nation-state actors.
One of the most notable aspects of this campaign is that it relies primarily on misconfigurations rather than advanced exploits.
According to the advisory, the attackers abuse:
This demonstrates that many successful nation-state operations continue to exploit basic security weaknesses instead of relying exclusively on sophisticated malware.
Protecting critical infrastructure requires continuous visibility across network devices, authentication events, endpoint activity, and infrastructure communications.
Seceon’s aiSIEM / CGuard helps organizations:
By correlating activity across the environment, Seceon helps expose long-term reconnaissance and persistence attempts that might otherwise remain unnoticed.
Seceon’s aiXDR-PMax extends visibility beyond the network by helping detect:
This enables security teams to detect attackers as they transition from network infrastructure into enterprise systems.
Because the advisory specifically focuses on critical infrastructure organizations, Seceon’s aiSecOT 360 provides additional visibility into operational environments by helping organizations:
This is especially valuable for sectors such as energy, utilities, transportation, manufacturing, and other organizations operating critical infrastructure.
The joint advisory from the UK and its allies reinforces an important cybersecurity lesson. Nation-state actors do not always rely on sophisticated exploits to achieve their objectives. In many cases, weak configurations and overlooked infrastructure provide everything they need.
As networking devices continue serving as the backbone of enterprise and critical infrastructure environments, they must receive the same level of monitoring and security attention as endpoints and servers.
Organizations that continuously monitor infrastructure behavior, harden network devices, and rapidly identify abnormal activity will be significantly better positioned to defend against long-term nation-state campaigns.
Understand the risks posed by compromised routers, exposed network management services, stolen configurations, and threats to OT environments.
Routers sit at important network boundaries and can reveal how systems communicate. Weak SNMP community strings, exposed management interfaces, default credentials, and known device vulnerabilities can give attackers opportunities to access network equipment. A compromised router may provide information about network topology and help attackers plan further activity. Organizations should restrict management access and keep network devices patched and securely configured.
Teams should determine which device received the requests, whether the source was authorized, and whether weak or default SNMP community strings are configured. They should also review management access logs, configuration changes, unusual file transfers, and related authentication events. SNMP activity alone does not prove a compromise; investigators should correlate it with other evidence and validate the affected device's configuration and exposure.
Depending on its contents, a router configuration may disclose routing rules, internal network addresses, VPN settings, management details, and potentially sensitive credentials. This information can help an attacker understand the environment and identify additional targets. Organizations should restrict access to configuration files and backups, protect stored copies, investigate unexpected exports, and rotate any credentials that may have been exposed.
Prioritize replacing default credentials, using SNMPv3 where supported, disabling unnecessary legacy SNMP services, and restricting management interfaces to trusted administrative networks. Apply vendor security updates, disable unused management features, and replace unsupported equipment. Operators should also review device configurations regularly and monitor for unauthorized changes. These controls reduce exposure but should be combined with incident response planning and ongoing monitoring.
Seceon aiSIEM / CGuard can help security teams correlate supported network-device, authentication, and security events to investigate suspicious activity in context. Seceon aiXDR-PMax can support investigation of related activity across the telemetry sources it supports. The usefulness of this approach depends on whether the relevant router logs and other data sources are collected, integrated, and configured for monitoring; a platform should not be assumed to see every router event automatically.
Organizations should verify which OT assets, network segments, protocols, and telemetry sources their monitoring solution actually supports. They should also assess whether alerts can help identify suspicious communication between enterprise IT and operational networks without disrupting industrial processes. Seceon aiSecOT360 may be evaluated against these requirements as part of an OT security assessment. Coverage should be confirmed against the organization's architecture and the product's supported capabilities rather than assumed.
