# FSB Centre 16 (Berserk Bear/Energetic Bear) targets global critical national infrastructure via vulnerable routers — joint UK & allied advisory

> The UK NCSC and 18 agencies from 12 countries warn that Russian FSB Centre 16 actors (aka Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard, Static Tundra) are actively exploiting vulnerable routers globally — scanning for devices with default or weak SNMP community strings, exploiting Cisco Smart Install (CVE-2018-0171, CVSS 9.8), and exfiltrating device configurations via TFTP to actor-controlled VPS infrastructure. The UK and EU member states formally attributed the December 2025 destructive attack on Poland's energy grid (DynoWiper/LazyWiper wipers, 30+ wind/PV farms, CHP plant serving 500,000 customers) to Centre 16, and the UK sanctioned 24 individuals and entities in the first joint UK-EU cyber sanctions package.

- **Published:** 2026-07-13T00:00:00Z
- **Last reviewed:** 2026-07-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2375
- **ID:** TL-2026-2375
- **Severity:** HIGH (CVSS 9.8)
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** FSB Centre 16 (Russia)
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2018-0171, CVE-2008-4128

## Description

FSB Centre 16 (Russia's Federal Security Service Information Security Center) is conducting a persistent global campaign targeting inadequately configured networking devices, primarily routers, to gain initial access to critical national infrastructure (CNI) networks. The actors scan internet IP ranges for SNMP agents accepting default or common community strings, sending SNMP Set-Requests from spoofed IP addresses via proxies. These requests use OID 1.3.6.1.4.1.9.9.96.1.1 (Cisco Config Copy) to instruct vulnerable devices to copy their configuration — often saving it as 'config.bkp' or 'output.txt' — and exfiltrate it via TFTP to actor-controlled leased VPS servers or compromised FTP servers. The configuration files contain device credentials including weakly-hashed Cisco Type 7 and plaintext Type 0 passwords, enabling further compromise.

In addition to SNMP abuse, the actors exploit known vulnerabilities including CVE-2018-0171 (Cisco Smart Install remote code execution, CVSS 9.8, on CISA KEV) and CVE-2008-4128 (Cisco IOS CSRF targeting EOL devices) to compromise Cisco devices, and exploit web management portal flaws on various network equipment. The campaign targets CNI sectors including communications, defence, energy, financial services, government, and healthcare.

On 29 December 2025, this actor cluster conducted its first publicly documented destructive attack — a coordinated assault on Poland's energy sector targeting 30+ wind and photovoltaic farms, a large combined heat and power (CHP) plant supplying heat to approximately 500,000 customers, and a manufacturing company. The attackers gained initial access via FortiGate VPN concentrators using compromised credentials without MFA, exploited shared VPN credentials across multiple facilities, and leveraged privileged AD accounts to deploy DynoWiper (native Windows binary using Mersenne Twister PRNG for pseudorandom file overwriting) and LazyWiper (PowerShell-based script with C# WriteRandomBytes function) via GPO-based scheduled tasks. OT devices including Hitachi Energy RTU560 controllers, Moxa NPort 6xxx serial servers, and Mikronika RTU/HMI panels were also directly targeted by uploading corrupted firmware (RTU560) or factory-resetting devices (NPort 6xxx), permanently damaging controllers. The CHP plant attack was blocked by ESET PROTECT EDR before wiper malware could detonate. Approximately 1.2 GW of generation capacity was attacked — roughly 5% of Poland's total capacity.

On 13 July 2026, the UK government jointly with EU member states formally attributed the Poland energy grid attack to FSB Centre 16, and the UK Foreign Office sanctioned 24 individuals and entities including FSB Centre 16-linked actors, GRU Unit 29155 leadership, Lumma Stealer operators, and Rybar LLC propagandists. The same day, a joint cybersecurity advisory co-signed by 19 agencies from 12 countries (led by NSA, CISA, FBI, NCSC-UK, and partners from Australia, Canada, Czech Republic, Denmark, Estonia, Finland, France, Italy, New Zealand, Poland, and Sweden) was published detailing FSB Centre 16's router exploitation TTPs and recommending mitigations including SNMPv3 migration, Smart Install disablement, and multi-factor authentication.

Attribution of the Poland energy attack to Centre 16 is contested by ESET, which assesses with medium confidence that the DynoWiper malware's TTPs align with GRU Unit 74455 (Sandworm/Seashell Blizzard), citing links to the ZOV wiper previously used in Ukraine. CERT Polska's technical attribution is based on overlaps in compromised VPS infrastructure, routers, traffic patterns, and anonymizing infrastructure consistent with the Centre 16-linked cluster. The broader consensus across the UK government, EU member states, CERT Polska, and CISA/NATO partners attributes the router scanning campaign unequivocally to FSB Centre 16, while the Poland attack is more complex due to apparent inter-service tool-sharing or coordinated operations between Russian intelligence agencies.

## MITRE ATT&CK

- T1595.001 Active Scanning: Scanning IP Blocks
- T1595.002 Active Scanning: Vulnerability Scanning
- T1583.003 Acquire Infrastructure: Virtual Private Server
- T1584.008 Network Devices
- T1588.005 Obtain Capabilities: Exploits
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1569 System Services
- T1053 Scheduled Task/Job
- T1027 Obfuscated Files or Information
- T1090 Proxy
- T1003 OS Credential Dumping
- T1018 Remote System Discovery
- T1602.001 SNMP (MIB Dump)
- T1602.002 Data from Configuration Repository: Network Device Configuration Dump
- T0802 Automated Collection
- T1071 Application Layer Protocol
- T1048 Exfiltration Over Alternative Protocol
- T1485 Data Destruction
- T1490 Inhibit System Recovery
- T1561 Disk Wipe

## Sources

- [UK and allies urge critical sectors to improve defences against Russian intelligence targeting](https://www.ncsc.gov.uk/news/uk-and-allies-urge-critical-sectors-to-improve-defences-against-russian-intelligence-targeting)
- [Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting (CISA AA26-194A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-194a)
- [NSA and Partners Release Guidance on Improving Router Hygiene](https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4541059/nsa-and-partners-release-guidance-on-improving-router-hygiene-to-protect-agains/)
- [Russian Government Cyber Actors Targeting Networking Devices — FBI PSA I-082025-PSA](https://www.fbi.gov/investigate/cyber/alerts/2025/russian-government-cyber-actors-targeting-networking-devices-critical-infrastructure)
- [CERT Polska Energy Sector Incident Report — December 2025](https://cert.pl/en/posts/2026/01/incident-report-energy-sector-2025/)
- [UK and EU strike Russian cyber networks with new sanctions](https://www.gov.uk/government/news/uk-and-eu-strike-russian-cyber-networks-with-new-sanctions)
- [Cyber / Russia: Statement by the High Representative on behalf of the European Union](https://www.consilium.europa.eu/en/press/press-releases/2026/07/13/cyber-russia-statement-by-the-high-representative-on-behalf-of-the-european-union-denouncing-russia-s-malicious-cyber-ecosystem-targeting-the-eu-its-member-states-and-international-partners/)
- [CISA/FBI/DOE Joint Advisory: TTPs of Indicted State-Sponsored Russian Cyber Actors Targeting the Energy Sector (AA22-083A)](https://www.cisa.gov/sites/default/files/publications/AA22-083A_TTPs_of_Indicted_State-Sponsored_Russian_Cyber_Actors_Targeting_the_Energy_Sector.pdf)
- [MITRE ATT&CK Group G0035 — Dragonfly](https://attack.mitre.org/groups/G0035/)
- [Cisco Advisory: Smart Install Remote Code Execution (CVE-2018-0171)](https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20180328-smi2.html)
- [DynoWiper Cyberattack Polish Energy Sector — Technical Analysis](https://nflo.tech/knowledge-base/dynowiper-cyberattack-polish-energy-sector-technical-analysis/)
- [Energetic Bear — more like a Crouching Yeti (Kaspersky Securelist)](https://securelist.com/energetic-bear-more-like-a-crouching-yeti/65240/)
- [The Baffling Berserk Bear (Slowik, VB2021)](https://vblocalhost.com/uploads/VB2021-Slowik.pdf)
- [CERT Polska Follow-Up Analysis of the 29 December 2025 Energy Sector Incident](https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Follow_up_Report_2025.pdf)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2375