CISA, NSA, FBI, DC3, & International Partners Urge Improved Router Hygiene to Protect Against Russian State-Sponsored Targeting

07/13/2026 2:30 PM EDT

Today, the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), the Federal Bureau of Investigation (FBI), the Defense Cyber Crime Center (DC3), and international partners released a joint cybersecurity advisory, Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting, addressing ongoing opportunistic exploitation of vulnerable networking devices by Russian Federal Security Service (FSB) Center 16 cyber threat actors.

This advisory builds on the FBI’s August 2025 public service announcement, providing updated information on the tactics, techniques, and procedures used by Russian FSB cyber threat actors who continue to target critical infrastructure—including the Communications, Defense Industrial Base, Energy, Financial Services, Government Services and Facilities, and Healthcare and Public Health sectors—by scanning for and exploiting poorly configured routers and network devices.

Russian FSB Center 16 actors have been observed exploiting multiple vulnerabilities in Cisco devices and network management portals, including CVE-2018-0171 and CVE-2008-4128. Both are listed in CISA’s Known Exploited Vulnerabilities (KEV) Catalog, with CVE-2008-4128 added today.

The advisory outlines practical steps organizations can take to harden their networks against exploitation, such as upgrading device configurations, enabling stronger authentication protocols, and monitoring for suspicious activity. All network defenders and device owners are strongly encouraged to review the recommended mitigations and take immediate action to reduce risk.

Read the advisory and visit CISA’s Russia Threat Overview and Advisories webpage to protect your organization’s networks and critical assets against nation-state threat actor activity.