Nineteen Agencies From Thirteen Countries Wrote a Router Advisory With Zero Indicators In It. That Absence Is the Finding.

Advisory AA26-194A landed this month with nineteen agencies from thirteen countries co-sealing it — NSA, CISA, FBI, DC3, and their counterparts across Australia, Canada, New Zealand, the UK, Czechia, Denmark, Estonia, Finland, France, Italy, Poland, and Sweden. That is an unusually crowded signature block. The subject is Russian FSB Center 16 and a campaign against routers that the FBI describes as running for over a decade.

Then you go looking for the indicator list, and there isn't one. No C2 IPs. No hashes. No domains. For a joint advisory of that weight, that is remarkable — and once you understand why, it tells you more about your exposure than any block list would have.

Why there are no indicators

The technique is SNMP. The actors scan the internet for devices running SNMP v1 or v2c that still accept default or common community strings, then send SNMP Set-Requests containing OIDs that instruct the device to copy its own running configuration to a file — often named config.bkp or output.txt — and transfer it by TFTP to a leased VPS or a compromised FTP server.

Those Set-Requests are sent from spoofed source addresses, through proxies. That is the reason the advisory has no IP indicators: the source addresses are fiction. You cannot block them, enrich them, or hunt them, because they were never the actor's real infrastructure.

We publish an IP blocklist. It is one of the more useful things we give away. So let us be direct about this: our feed cannot help you with this campaign, and neither can anybody else's. There is nothing to list. When the initial access is a forged packet exploiting a default password, threat intelligence as a product category has very little to sell you. Configuration hygiene is the entire control. Anyone telling you their feed covers this is selling you something.

The evidence is already inside your own router

Here is the detail worth the price of reading the advisory, and it is the closest thing to an indicator that this campaign has.

The advisory names two OIDs to monitor and allow-list. The first, 1.3.6.1.4.1.9.9.96.1.1, is Cisco's config-copy function. The second, 1.3.6.1.4.1.9.9.96.1.1.1.1.5, is the config-copy server address — and as the advisory notes, the value of that OID is where the configuration file is being sent.

That is not a threat-feed indicator. That is a field in your own device, and its contents are the attacker's destination. If this happened to you, your router recorded where your config went. The IOC for this campaign is sitting in your equipment waiting to be read, which is a very different defensive posture than waiting for a vendor to publish a list.

Write IDS rules for inbound SNMP Set-Requests carrying OIDs that touch sensitive device data. Allow-list the MIB OIDs you actually need. That is a detection you build, not one you subscribe to.

The router control plane is the target, and this is the patient version

We have written about this surface repeatedly and from the other direction. Seven Cisco Catalyst SD-WAN Manager zero-days in thirteen months. In May we argued you could chain the SD-WAN Manager flaws to go from an anonymous HTTP request to controlling every router in the fabric; in July, Talos named UAT-8616 as an actor who had been running that exact chain since 2023. In April we covered Russia's GRU hijacking router DNS to harvest M365 OAuth tokens.

Different service, same real estate. Center 16 is the FSB, not the GRU, and their approach is the patient inverse of the CVE-chain story: no exploit needed, just an unchanged community string and a decade of quiet collection. The advisory says they occasionally reach for CVE-2018-0171 (Cisco Smart Install) and CVE-2008-4128 — and that second one only affects end-of-life devices, which tells you plainly what part of the internet they expect to still be listening.

A stolen router configuration is a very good haul. It contains your topology, your ACLs, your VPN endpoints, your SNMP strings, and your password hashes — and if those hashes are Cisco type 0, 4, or 7, they are plaintext or trivially reversed. The config is not the objective. It is the map used to plan the next move, which is why a campaign can run for ten years without anyone noticing the theft.

The advisory also notes these TTPs overlap with Salt Typhoon. Two unrelated state programs converging on the same technique against the same devices is not coincidence — it is confirmation that the router control plane is under-defended enough to be worth a decade from two different governments.

Eight things to do, in order

Disable Cisco Smart Install on every device. It is an initial-provisioning feature that should be off the moment provisioning is done. This is first because it costs nothing and closes the one CVE path in the advisory.

Kill SNMPv1 and SNMPv2c. These are the campaign. If you truly need them, change every community string off its default and grant read-only, never read-write.

Move to SNMPv3 with authPriv at the strongest encryption the device supports. v3 replaces cleartext community strings with real authentication and encryption.

Block the ports at the edge — deny inbound and outbound on UDP 69 (TFTP), TCP 4786 (Smart Install), UDP 161 and 162 (SNMP), and TCP/UDP 10161 and 10162 (SNMPv3). The TFTP block is what breaks the exfiltration leg even if the SNMP request lands.

Re-hash your device credentials to Cisco type 8. Avoid types 0, 4, and 7. If a config was stolen years ago, everything in it that is reversible is already gone; rotate on that assumption.

Allow-list SNMP MIB OIDs and alert on the two config-copy OIDs above.

Restrict management protocols with ACLs so SNMP is reachable only from your management network, preferably out-of-band.

Upgrade end-of-life devices. CVE-2008-4128 is an eighteen-year-old bug in the advisory because the devices are still out there.

Six names, one unit

The advisory lists the industry aliases for this group: Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard, and Static Tundra. Six vendor names for one FSB unit.

That sprawl is a defender tax we keep running into. A small utility reads a Dragonfly write-up, files it, then reads a Static Tundra report months later and has no idea it is the same organization. Coverage looks broader than it is and gaps hide inside the naming. We build our adversary profiles around the full alias set for exactly this reason — so that whichever name you arrived with, you land on the same file.

We got a live demonstration of the tax while writing this. Searching our own feed for Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, and Ghost Blizzard returned nothing — five of the six names, empty. Under Static Tundra we hold four C2 IP addresses, ingested July 18, tied to the SYNful Knock Cisco router implant, with sightings running from March 2023 through July 2025. Same unit. One alias populated, five blind. If we had queried any of the other five names and stopped there, we would have concluded we had no coverage of an actor we do in fact track — which is precisely the failure mode we are describing, happening to us.

So: four C2 indicators for this lineage, zero blog posts before this one, and profile stubs so thin that five of the six aliases had no record at all. The C2 addresses are useful for hunting historical beacons. They are also not the initial access described above, which remains unblockable. Both things are true and neither cancels the other.

The point

Most of what gets sold as threat intelligence is a list of things to block. This advisory is nineteen agencies explaining, at length, that for this campaign there is no such list — and that your exposure is determined entirely by whether a protocol from 1988 is still answering to the string "public" on a device with a public IP.

Go find out what your routers say when a stranger asks them politely. Then read the config-copy server OID and see whether anything already asked.

Call the technical read 95% — the residual is that a decade-long collection campaign is described by the victims who were eventually found, and the shape of the ones who weren't is exactly what nobody in that signature block can tell you.

---

How do AI models see YOUR brand?

AIPM has audited 250+ domains. 15 seconds. Free while still in beta.

Audit your site now → aipmsec.com