On July 13, 2026, nineteen intelligence and cybersecurity agencies from thirteen countries — including NSA, CISA, FBI, and DC3 alongside fifteen international partners — published a joint advisory identifying FSB Center 16 as the actor behind a sustained campaign to harvest router configurations and credentials from critical infrastructure networks worldwide. The advisory, AA26-194A, is unusually direct in attribution and unusually specific in technique.
What they’re doing
The technique is not novel. It is old, reliable, and widely understood — which makes its continued effectiveness alarming.
FSB Center 16 is exploiting default SNMP community strings on internet-facing routers. Cisco IOS devices, and many others, ship with community strings of public (read) and private (read-write). Operators who never changed these defaults have effectively handed over read access to their router’s management plane to anyone who asks. Via SNMP, an attacker with the correct community string can retrieve routing tables, interface configurations, OSPF and BGP neighbour relationships, ACL configurations, and — depending on the device and IOS version — password hashes.
The same campaign also targets deployments with Cisco Smart Install still enabled. Smart Install is a legacy provisioning protocol that listens on TCP 4786. It was never designed with authentication; it was designed for zero-touch provisioning in controlled environments. Cisco has advised disabling it for years. In environments where it remains active, FSB Center 16 is exploiting it to retrieve running configurations directly, using the cisco_smart_install module and known CVEs against unpatched IOS versions.
The payload in both cases is the router configuration itself — exported via TFTP (UDP 69) to FSB-controlled collection infrastructure.
What’s in a router config
The advisory’s significance lies partly in what the exfiltrated data contains. A running configuration from a core network router is not a minor intelligence collection. It includes:
- All interface IP addresses and subnet assignments
- VPN pre-shared keys and tunnel endpoints (for IKEv1 deployments)
- OSPF, EIGRP, and BGP configurations including neighbour authentication keys
- SNMP v1/v2c community strings for lateral movement to other devices on the same management plane
- Local credentials: enable passwords, line passwords, AAA authentication configurations, and often SHA-hashed usernames from the
usernameglobal configuration database
A single collected configuration can provide the credentials needed to access adjacent routers, a map of the network topology, and the authentication material to impersonate tunnel endpoints. For FSB signals intelligence purposes, this collection is the infrastructure survey that enables everything else.
Who’s targeted
The advisory names specific sector focus: communications providers, defence industrial base, energy companies, financial services institutions, and state and local government entities. Healthcare is also listed. The geographic scope is described as global, with activity identified across North America, Europe, and the Indo-Pacific.
The breadth of the joint attribution — thirteen countries signed onto this advisory — reflects that the targeting is not confined to US-affiliated infrastructure. European telecoms and energy operators are explicitly in scope.
Eight mitigations, two that matter most
The advisory lists eight recommended mitigations. In practice, two address the core exposure:
Disable Cisco Smart Install and block TCP 4786 at the perimeter. If Smart Install is enabled and the device is internet-facing or reachable from untrusted segments, it is vulnerable. There is no authentication to bypass. no vstack on IOS/IOS-XE is the fix; blocking TCP 4786 at the edge firewall is the containment measure while remediation is in progress.
Migrate SNMP to v3 with authPriv. SNMPv1 and SNMPv2c send community strings in cleartext over UDP and have no meaningful authentication. SNMPv3 with authentication (SHA) and privacy (AES) eliminates the community-string guessing attack surface entirely. For devices where SNMPv3 is not available, restricting SNMPv1/v2c access via ACL to specific management station IPs and rotating community strings off defaults is the minimum viable mitigation.
The remaining six mitigations are good hygiene — block TFTP (UDP 69) at the perimeter, rotate credentials on devices where SNMP was accessible with defaults, alert on SNMP Cisco Config Copy OIDs (1.3.6.1.4.1.9.9.96), review IOS versions against Cisco security advisories — but the first two eliminate the primary exploitation paths.
Why this is getting a 19-agency advisory in 2026
Default SNMP community strings are not a new vulnerability class. Neither is Cisco Smart Install exploitation. NSA and CISA have published guidance on both issues repeatedly. The advisory itself references previous publications going back several years.
The reason for a joint advisory with this level of country sign-on is likely detection: the agencies collectively have enough visibility into FSB Center 16’s collection infrastructure to attribute the activity, describe the scope of targeting, and justify a public warning. The campaign has apparently been running long enough, and successfully enough, to warrant the coordination investment.
The practical implication for defenders is that this is active collection, not historical. Devices that have been accessible with default SNMP credentials may have already contributed their configurations to FSB intelligence collection. The immediate response is the same as for any credential exposure: rotate credentials, review what was accessible, and assess what the configuration would have revealed.
Network device hygiene remains among the lowest-hanging defensive fruit available. The fact that it needs a 19-agency joint advisory in 2026 to drive adoption is a reasonable measure of how far the gap between advisory publication and operational change remains.