State-backed hackers are exploiting poorly configured routers

What happened

In July 2026 the ASD’s ACSC joined the US NSA, CISA and FBI, and agencies from Canada, New Zealand, the UK and several European countries, in a joint advisory about cyber actors linked to Russia’s Federal Security Service (FSB Centre 16).

The agencies say these actors have spent more than a decade opportunistically compromising poorly configured and vulnerable network devices worldwide, including in critical infrastructure.

How the attacks work

The technique is simple, which is why it keeps working:

• Scanning the internet for routers that respond to old versions of SNMP, a protocol used to monitor and manage network devices.
• Logging in using default or common SNMP “community strings”, which act like shared passwords.
• Copying the router’s configuration to a server the attacker controls. Configurations can contain password hashes, network details and other information useful for further attacks.

Why it matters for smaller organisations

You don’t need to be a government agency to be caught up in this. The attackers look for weak devices, not particular targets. A compromised router in a small office can expose staff credentials, let attackers watch or redirect traffic, or be used to hide attacks on other organisations.

Older business routers and firewalls, often installed years ago and never revisited, are the most likely to have these settings.

What the agencies recommend

These are technical steps, so share them with whoever manages your network:

• Use SNMP version 3 (which has proper authentication and encryption), or turn SNMP off if it isn’t needed.
• Block SNMP, TFTP and Cisco Smart Install traffic at the internet edge.
• Store device passwords securely, using strong password types on Cisco devices, and don’t reuse passwords across devices.
• Disable Cisco Smart Install after initial setup.
• Keep router firmware updated, and replace devices that no longer receive updates.

Questions to ask your IT provider

• Which routers and firewalls do we have, and are they all still supported and updated?
• Is SNMP enabled, and if so, which version?
• Can anyone reach the management interface from the internet?
• When were device passwords last changed?

For home and home-office routers, our guide to securing your home Wi-Fi covers the equivalent basics.