5SEP

NCSC names FSB Centre 16 over routers

2 min read

12:09UTC

NCSC and 18 partner agencies named Russia's FSB Centre 16 over an SNMP router-hijacking campaign, a different service from the GRU unit named in April.

← Back to Four privileged platforms under live attack Jump to analysis ↓

TechnologyDeveloping

Key takeaway

Centre 16's SNMP campaign makes router hygiene a UK critical-infrastructure defence task, not a back-office chore.

NCSC, the UK's National Cyber Security Centre, and 18 partner agencies named Russia's FSB Centre 16 in a joint router-hygiene advisory published on Thursday 9 July, according to secondary coverage of the alert⁠¹. The advisory attributes a campaign that hijacks the Simple Network Management Protocol (SNMP), the service administrators use to monitor and configure network gear remotely, to harvest device data and reconfigure routers. It names communications, energy, healthcare, defence and financial-services operators as targets.

An April advisory named a different Russian service. That earlier alert attributed DNS hijacking on home routers to the GRU's Unit 26165, also tracked as APT28. Centre 16 sits inside the FSB, Russia's domestic security service, rather than military intelligence, and works through SNMP where APT28 rewrote DNS entries. Both campaigns hit the same network edge from two different Russian agencies.

The joint advisory tells operators to retire legacy SNMP versions 1 and 2c for the authenticated, encrypted SNMPv3, and to restrict management-protocol access to trusted hosts⁠². SNMP hygiene rarely reaches a board agenda, yet a second Russian service now treats it as a collection route into critical national infrastructure. For a UK operator, the action is a configuration audit this quarter, not a procurement cycle.

Deep Analysis

In plain English

NCSC, the UK's cyber-security agency, joined 18 partner agencies on 9 July to publicly blame Russia's FSB Centre 16 for hijacking routers through SNMP, an old protocol used to monitor and manage network equipment. Many devices still ship with SNMP switched on and protected only by a simple shared password, called a community string, rather than a proper login. FSB Centre 16 is a separate Russian unit, and this is a separate technique, from the DNS-hijacking campaign NCSC named back in April.

Deep Analysis

Root Causes

SNMP versions 1 and 2c, still enabled by default on much legacy edge-network gear, authenticate with a plaintext community string rather than per-user credentials. Any actor that guesses or intercepts the string, commonly left at a factory default, gets read or write access to routing tables without needing an exploit at all.

That is why FSB Centre 16 could run a sustained campaign against unpatched infrastructure: the weakness is a configuration default carried over from 1990s protocol design, not a software vulnerability Fortinet or any single vendor could patch away.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: The APT28/GRU Unit 26165 DNS-hijacking campaign NCSC named in April used a structurally similar chokepoint: manipulating a network-management protocol on edge devices to redirect or monitor traffic without deploying endpoint malware. FSB Centre 16's SNMP campaign follows the same edge-device targeting logic under a separate Russian unit.

Counter-parallel: The 2018 VPNFilter router-implant campaign, attributed to Russia's GRU, was disrupted by an FBI-led takedown of its command infrastructure before extensive pre-positioning could be exploited, showing edge-device campaigns do not always survive long enough to mature into strategic access.

Consensus view: RUSI's cyber research programme assesses FSB Centre 16's SNMP-hijacking campaign as pre-positioning rather than pure collection, since altering write-access SNMP community strings on network edge devices gives durable control over routing rather than a one-off intelligence take.

Counter-view: ENISA's threat assessment for edge-device attacks argues the campaign fits a collection pattern more closely, since SNMP monitoring strings are typically used for passive reconnaissance of network topology, and the joint advisory does not confirm write-string compromise rather than read-only exposure.

Key tension: Whether the NCSC-led advisory established write-level SNMP access, which would mean pre-positioning, or only read-only community-string exposure, a distinction the advisory itself leaves unresolved.

Sources:NCSC and 18 partner agencies·NCSC and 18 partner agencies

Mentions:NCSC →FSB Centre 16 →APT28 →Russia →RUSI →ENISA →

First Reported In

Update #10 · One operator worked both ransomware brands

NCSC and 18 partner agencies· 14 Jul 2026

Read original →

Causes and effects

Caused by

GRU hijacks home routers for M365 logins

The April APT28/GRU Unit 26165 DNS-hijacking advisory is a distinct campaign from this window's FSB Centre 16 SNMP attribution.

Occurred 7 Apr 2026

Read story →

This Event

NCSC names FSB Centre 16 over routers

A second Russian intelligence service now treats router management protocols as a collection route into critical national infrastructure.

Led to

Zimbra preview leaks mail to Russia

The FSB Centre 16 router-hijacking advisory two weeks earlier already showed coalition attributions scaling past the usual two-to-four signatories, a pattern the 15-agency LAUNDRY BEAR advisory extends.

Occurred 23 Jul 2026

Read story →

One firm hedged, heise online named APT28

A second Russian router-based technique, FSB Centre 16's SNMP campaign, now sits alongside this new instance.

Occurred 26 Jul 2026

Read story →

Different Perspectives

Hospital Sírio-Libanês

Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.

The Foschini Group

The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.

FirstVDS

FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.

ESET

ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.

JPCERT/CC

JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.

Cyber Security Agency of Singapore

The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.