FSB Center 16 Exploitation of Routers via SNMP

The Russian FSB Center 16 (also tracked as Static Tundra, Berserk Bear, and Dragonfly) has conducted a decade-plus campaign targeting global critical infrastructure by compromising poorly configured routers. Unlike groups focused on disruption, Center 16 primarily operates as a signals-intelligence unit for espionage, systematically harvesting network configuration files to gain credentials and establish persistence within sensitive environments.

The group's primary tradecraft involves scanning for SNMP agents with default community strings to trigger the Cisco CISCO-CONFIG-COPY-MIB, causing devices to exfiltrate their own running configurations to attacker-controlled TFTP servers. While they prioritize low-tech protocol abuse, they also leverage known vulnerabilities such as CVE-2018-0171 (Cisco Smart Install) and legacy flaws like CVE-2008-4128. This activity is critical because stolen configurations often contain weakly hashed passwords that facilitate lateral movement into protected ICS/SCADA and business networks.