Western Allies Warn of Russian Hackers Targeting Critical Infrastructure
Russian state-backed hackers associated with Moscow’s FSB are actively targeting critical infrastructure networks worldwide by exploiting vulnerabilities in routers and other networking devices, as warned by the United States and 12 allied nations. The advisory, issued by agencies including the NSA, Cybersecurity and Infrastructure Security Agency, and the FBI, highlights the ongoing threat posed by the FSB’s Center 16 signals intelligence unit, which has been compromising organizations across various sectors such as communications, defense, energy, financial services, government, and healthcare due to weak security measures.
The advisory points out that Center 16 operators have taken advantage of poorly configured routers and have exploited specific vulnerabilities, including Cisco’s Smart Install feature and at least two known flaws in Cisco devices. One of these vulnerabilities was recently added to CISA’s Known Exploited Vulnerabilities catalog, which tracks cyber vulnerabilities that hacker groups have utilized.
This warning comes on the same day that the United Kingdom and European Union formally attributed a failed cyberattack against Poland’s energy grid in December 2025 to Center 16. UK officials indicated that this attack could have potentially cut electricity to approximately 500,000 individuals during the winter months. EU foreign policy chief Kaja Kallas condemned Russia’s actions, stating that the misuse of cyber capabilities to target public services and critical infrastructure leads to significant disruptions and financial losses.
In light of these threats, former U.S. officials are advising organizations to enhance their router security. Matt Hartman, chief strategy officer at Merlin Group and former senior official at the Cybersecurity and Infrastructure Security Agency, emphasized the importance of treating internet-facing network infrastructure as a critical attack surface. He recommended eliminating default credentials, restricting access to management interfaces, and ensuring that routers receive the same level of monitoring and patching as other vital systems.
Lou Eichenbaum, former chief information officer at the U.S. Department of the Interior, echoed these sentiments, advising organizations to prepare for the eventual compromise of routers or other perimeter devices. He stressed that the goal should not only be to prevent initial intrusions but also to contain any breaches to prevent operational disruptions.
