FSB Centre 16
A unit of Russia's FSB domestic security service attributed with an SNMP-based router-hijacking campaign.
Last refreshed: 14 July 2026 · Appears in 1 active topic
Why did NCSC name FSB Centre 16, not APT28, over the router-hijacking campaign?
Timeline for FSB Centre 16
Ran an SNMP-hijacking campaign against network edge devices
Cybersecurity: Threats and Defences: NCSC names FSB Centre 16 over routersWhat is FSB Centre 16?
Is FSB Centre 16 the same as APT28?
Why did NCSC publish an advisory on FSB Centre 16?
Background
The UK's NCSC and 18 partner agencies published a joint advisory on 9 July 2026 attributing a router-hijacking campaign that abused the SNMP protocol on network edge devices to FSB Centre 16, explicitly distinguishing it from the GRU Unit 26165/APT28 DNS-hijacking campaign named in April 2026.
Centre 16 (also known as Center 16 or the 16th Centre, and historically as military unit 71330) is the FSB's signals-intelligence directorate. It has long been linked by Western agencies to the Berserk Bear / Dragonfly / Energetic Bear intrusion activity, which has targeted energy and industrial-control networks.
The distinction from APT28 matters: FSB and GRU units run separate operations with different tradecraft and targets, and conflating them muddies attribution across the Russia-linked cyber campaigns Lowdown is tracking in both this topic and the wider Russia-Ukraine conflict.