UK and allies urge critical sectors to strengthen router security against Russia

The UK’s National Cyber Security Centre (NCSC) and international partners have urged critical infrastructure operators to improve the security of internet-facing routers and network devices following continued exploitation by Russian state-linked cyber actors.

The joint advisory, published on 9 July 2026, was issued by the NCSC alongside 18 partner agencies from 12 countries, including Australia, Canada, the Czech Republic, Denmark, Estonia, Finland, France, Italy, New Zealand, Poland, Sweden and the United States.

The guidance warns that cyber actors linked to FSB Centre 16 have been targeting critical infrastructure by exploiting poorly configured routers, weak passwords, legacy protocols and known vulnerabilities.

The advisory is aimed at organisations operating across sectors including communications, defence, energy, financial services, government and healthcare.

Critical Sectors Urged to Improve Router Security

The advisory attributes the activity to FSB Centre 16, a Russian intelligence unit also tracked under names including Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard and Static Tundra.

According to the NCSC, the group has been scanning the internet for routers that still use default or weak Simple Network Management Protocol (SNMP) passwords and community strings.

The group has also exploited known vulnerabilities affecting Cisco devices, Cisco Smart Install and web portal flaws to gain control of network devices.

“Today’s joint advisory provides decisive, actionable directions from the global security community that network defenders should implement to protect against Russian Intelligence operations and secure the UK’s critical infrastructure,” said Jonathon Ellison, NCSC Director of National Resilience.

The NCSC urged organisations, particularly those responsible for critical networks, to apply the recommended measures immediately.

Common Weaknesses Remain Exposed

A notable feature of the advisory is that many of the techniques described rely on weaknesses organisations already know how to address.

The guidance focuses on exposed management services, outdated SNMP configurations, weak credentials and unpatched devices. These are not new problems, but they continue to provide access points into sensitive networks.

The recommended actions are practical. Organisations are urged to migrate to SNMPv3, disable legacy versions of SNMP, implement strong and unique passwords for network devices, and restrict access to management protocols.

For critical infrastructure operators, the advisory reinforces the importance of applying established controls consistently across networks that may include legacy devices and distributed operational environments.

Advisory Follows Wider Cyber Resilience Activity

The guidance follows recent UK and European cyber resilience announcements.

Last week, the UK Government launched its Cyber Resilience Pledge, encouraging organisations to strengthen board-level accountability and practical resilience measures.

The European Commission has also published its Action Plan on Cybersecurity and Artificial Intelligence, focused on AI evaluation, secure testing and operational capability.

The latest NCSC advisory is narrower in scope, but it reflects the same emphasis on implementation. For critical infrastructure, resilience depends on whether known risks are being managed across the systems that keep essential services running.

Russian Cyber Activity Remains Under Scrutiny

The advisory was published on the same day the UK Government announced sanctions against 24 individuals and entities linked to destructive Russian cyber and hybrid operations.

The UK and EU member states also formally attributed the December 2025 attack on Poland’s energy grid to FSB Centre 16. According to the UK Government, a successful attack could have left around 500,000 civilians without electricity.

That context gives the advisory additional weight, particularly for organisations responsible for nationally significant networks. The technical guidance remains focused on immediate defensive action rather than geopolitical assessment.

Router Security Becomes Part of Infrastructure Resilience

Routers and other internet-facing network devices rarely receive the same attention as advanced malware or AI-enabled threats. The NCSC advisory shows why they remain important. Weak configurations, exposed services and unpatched devices can create routes into critical networks, even when the techniques used by attackers are familiar.

For organisations operating essential services, router security is therefore part of resilience planning. Reducing avoidable exposure across common network devices can limit the opportunities available to hostile actors before more complex incident response is required.

Join Cloud & Cyber Security Expo Paris

18 - 19 November 2026, Porte de Versailles, Paris

Prove control. Strengthen resilience. Govern cyber risk.

Join CISOs, risk leaders and IT decision-makers exploring identity security, threat detection, incident response, and compliance across cloud, hybrid and distributed environments.

Register for Cloud & Cyber Security Expo Paris