CISA warns: Russian FSB uses misconfigured routers as proxies for cyberattacks

What happened?

On July 13, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) published a joint alert with agencies from Australia (ACSC), Denmark (CFCS), New Zealand (NCSC-NZ), and the United Kingdom (NCSC-UK) about a cyber operations campaign attributed to the FSB's Center 16, Russia's foreign intelligence service. According to the technical report, the actors are compromising home and office routers with weak configurations in multiple countries and using them as residential proxies to hide the origin of their attacks on critical infrastructure. The joint alert, published under identifier AA26-194A, details that the campaign has been active since at least early 2025, with a significant increase in the second quarter of 2026. Target sectors include energy, water, healthcare, and transportation, primarily in the United States, Europe, and the Indo-Pacific region. Attribution to FSB Center 16 is based on previously documented tactics, techniques, and procedures (TTPs), as well as command-and-control infrastructure matching previous operations of the group known as APT29 or Cozy Bear.

How does the attack work?

The mechanism exploits the Simple Network Management Protocol (SNMP) in versions 1 and 2c, which many routers have enabled by default and which, in those versions, do not encrypt passwords, transmitting them in plaintext. The attack unfolds in three phases:

• Discovery: actors scan ranges of public IP addresses for routers with SNMP active and accessible from the internet, using tools like Masscan or Zmap to identify open UDP ports 161 and 162. According to CISA, over 2 million vulnerable routers have been identified in the United States alone.
• Exploitation: using weak or default credentials (such as 'public' or 'private'), they install persistent malware on the router via traffic with spoofed IP addresses. The malware, dubbed 'ProxyRouter' by researchers, modifies routing rules and establishes a reverse SSH tunnel to command-and-control servers.
• Integration: the compromised router becomes a node in the residential proxy network, from which new scans, brute-force attacks, and data exfiltration are launched. This method is particularly hard to detect because malicious traffic appears to originate from legitimate home and small business IP addresses, bypassing reputation systems based on geolocation or blacklists.

CISA's report notes that actors have also used living-off-the-land (LotL) techniques, abusing legitimate tools like curl and wget to download payloads, and have implemented persistence mechanisms that survive router reboots.

Why is this important?

CISA's alert underscores a systemic vulnerability: millions of routers worldwide remain unpatched, with default configurations and SNMP enabled. These devices, often forgotten by their owners, become unwitting accomplices in cyberattacks on critical infrastructure. The FSB operation demonstrates that residential and office routers are a low-cost, high-impact attack vector. According to Shodan, a search engine for connected devices, over 12 million routers worldwide have SNMP exposed on the internet, of which approximately 4 million use vulnerable versions (v1/v2c). The collaboration among five agencies indicates the severity and global reach of the threat. Moreover, the use of residential proxies allows attackers to bypass security measures based on IP reputation, such as those used by Cloudflare or Akamai, increasing the success rate of secondary attacks.

Consequences for businesses and users

For businesses, especially those with remote employees, the recommendation is to audit router configurations, disable SNMP if not needed, or upgrade to SNMPv3 which encrypts credentials. Companies should also implement network segmentation, anomalous traffic monitoring, and asset management policies that include routers. For home users, changing default passwords, keeping firmware updated, and reviewing network settings are critical steps. CISA specifically recommends verifying that SNMP is disabled on the WAN interface and, if needed on the LAN, using SNMPv3 with authentication and encryption. At the public policy level, this alert could accelerate regulation on IoT and router security, similar to cybersecurity labeling initiatives in the EU (Cyber Resilience Act) and the FCC's cybersecurity labeling program in the U.S. The potential economic impact is significant: according to a Ponemon Institute study, the average cost of a critical infrastructure attack is $4.7 million, not including reputational and regulatory damages.

Historical context

This is not the first time state actors have abused vulnerable routers. In 2018, the FBI dismantled the Russian VPNFilter botnet, which had compromised over 500,000 routers from brands like Linksys, MikroTik, Netgear, and TP-Link. VPNFilter used a similar approach: exploiting weak credentials and known vulnerabilities to install malware capable of intercepting traffic, launching DDoS attacks, and destroying device firmware. However, this new campaign stands out for its focus on SNMP and the use of residential proxies, a technique combining stealth and persistence. Unlike VPNFilter, which had destructive capabilities, ProxyRouter is designed to be stealthy and long-lasting, prioritizing concealment over immediate damage. It also differs from the 2014 operation against routers at the University of Cambridge, where Chinese actors used compromised routers to steal research data. The collaboration among five agencies indicates the severity and global reach of the threat, as well as the maturity of international cybersecurity relations.

What should readers know?

If you have a router at home or in the office, verify that SNMP is disabled if not in use, change the admin password, and ensure firmware is up to date. To check if your router is compromised, CISA recommends looking for outgoing traffic to unknown IP addresses on non-standard ports, as well as reviewing router logs for unusual configurations. Businesses should include routers in their asset management policies and conduct regular audits, especially those used by remote employees. CISA's alert is a reminder that cybersecurity starts with the most basic devices. As Javier Márquez noted on Xataka: "The router is the forgotten device on the network, and that makes it the perfect target for intelligence operations." The lesson is clear: the security of critical infrastructure also depends on each user's digital hygiene.

"The router is the forgotten device on the network, and that makes it the perfect target for intelligence operations." — Javier Márquez, Xataka.