FSB Centre 16
A unit of Russia's FSB domestic security service attributed with an SNMP-based router-hijacking campaign.
FSB Centre 16 is the Russian security-service unit that the UK's NCSC and 18 partner agencies named on 9 July 2026 over a router-hijacking campaign exploiting weak, default network-device credentials.
Last refreshed: 3 August 2026 · Appears in 1 active topic
Why did NCSC name FSB Centre 16, not APT28, over the router-hijacking campaign?
Timeline for FSB Centre 16
Mentioned in: One firm hedged, heise online named APT28
Cybersecurity: Threats and DefencesMentioned in: Zimbra preview leaks mail to Russia
Cybersecurity: Threats and DefencesMentioned in: Hotel WiFi steers guests to fake logins
Cybersecurity: Threats and DefencesRan an SNMP-hijacking campaign against network edge devices
Cybersecurity: Threats and Defences: NCSC names FSB Centre 16 over routersBackground
FSB Centre 16 is a unit of Russia's Federal Security Service. On 9 July 2026, the UK's National Cyber Security Centre and 18 partner agencies published a joint advisory attributing an SNMP-based router-hijacking campaign to the unit, distinguishing it from a separate group named over an earlier, April 2026 hijacking campaign that used a different technique.
The Centre 16 campaign exploited weak or default credentials on network gear rather than a software vulnerability, a technique that requires no new code from the attacker, only unremediated configuration on the victim's own equipment.
No further detail on Centre 16's structure, targeting priorities or scale is yet public beyond the attribution itself, and this page will stay short until further reporting names a specific incident or victim set tied to the unit.