Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting

This joint international advisory warns that Russian FSB Center 16 actors are actively scanning for and exploiting poorly configured networking devices—especially routers—by abusing SNMP (default/community strings), Cisco Smart Install, and known CVEs to copy and exfiltrate device configurations (often via TFTP) to actor-controlled servers; the advisory maps these TTPs to MITRE ATT&CK, identifies at-risk critical infrastructure sectors, lists example OIDs and IOCs, and provides prioritized mitigations such as enabling SNMPv3, disabling Smart Install, blocking management ports, enforcing strong credential storage, and updating device firmware.