Joint Advisory Warns of FSB-Linked Campaign Targeting Global Critical Infrastructure Routers

Executive Summary

Encrygma analysts are monitoring an escalating threat landscape following the July 14, 2026, joint advisory released by CISA, the FBI, and the NSA, alongside international allies from the UK, Canada, and Australia. The advisory details a sustained, high-impact campaign by Russian state-sponsored actors targeting the "soft underbelly" of critical infrastructure: edge networking devices and poorly configured routers. This operation, attributed to the Russian Federal Security Service (FSB) Center 16, also known as Dragonfly, Berserk Bear, or Ghost Blizzard, marks a significant pivot from passive intelligence gathering to active pre-positioning for potential kinetic disruption across Western nations.

Threat Analysis

The current campaign, which has been active through the mid-2020s and reached a peak in late 2025, leverages widespread vulnerabilities in Small Office/Home Office (SOHO) routers and enterprise-grade switches. The primary objective appears to be the large-scale extraction of configuration files. By gaining access to these files, the FSB can map internal network topologies, identify high-value Industrial Control System (ICS) targets, and bypass perimeter security through legitimate but compromised pathways. Threat actors are notably focusing on the Energy, Water, and Transportation sectors across North America and Western Europe, suggesting a strategic interest in sectors that would cause the most societal impact if disrupted.

Technical Details

The actors primarily exploit the Cisco Smart Install (SMI) protocol, specifically targeting unpatched devices vulnerable to legacy flaws and newer zero-days in network management interfaces. By sending malformed SMI packets, the attackers can trigger a reload of the device or gain the ability to execute arbitrary commands. Furthermore, the abuse of Simple Network Management Protocol (SNMP) versions 1 and 2, using default or easily guessable community strings, has allowed the group to exfiltrate full configuration backups without triggering modern EDR solutions. Once the configuration is stolen, the actors utilize "Living off the Land" (LotL) techniques, employing legitimate administrative tools to create persistent VPN tunnels. This allows them to maintain a low-profile presence that blends with normal administrative traffic.

Attribution Assessment

Encrygma concurs with the joint advisory's attribution to the Russian FSB Center 16 (Military Unit 71330). This assessment is based on the overlapping use of infrastructure, specifically the "LapDogs" Operational Relay Box (ORB) network, and the distinct tactical preference for long-term persistence within critical infrastructure management interfaces. The tradecraft observed—specifically the meticulous harvesting of network maps and the use of compromised SOHO routers as proxies—is a hallmark of Russian strategic doctrine aimed at creating permanent access points for use during periods of geopolitical escalation.

Implications

This discovery indicates that the threat to global infrastructure has entered a high-risk phase. The ability of a nation-state to hold critical services at risk via common networking flaws suggests a significant gap in global cybersecurity hygiene. If left unaddressed, these footholds could be used to launch synchronized destructive attacks, such as the deployment of wipers against power grids, potentially leading to widespread outages. The psychological impact of such pre-positioning is also intended to deter Western intervention in regional conflicts.

Recommendations

Immediate action is required for all organizations managing critical infrastructure. Administrators must disable Cisco Smart Install on all switches and migrate from SNMPv1/v2 to SNMPv3, which provides encrypted authentication. Additionally, organizations should implement strict IP-based access control lists (ACLs) for all management interfaces and conduct a comprehensive audit of all edge device configurations to ensure no unauthorized accounts or tunnels have been established. Regular rotation of administrative credentials and the implementation of multi-factor authentication for all remote access points remain the most effective defenses against these persistent state actors.