Multiple nations warned of router-based threats from notorious Russia-affiliated hacking group Berserk Bear as Europe stepped up efforts against various hacktivist groups.

In a joint advisory spanning 18 agencies from 12 countries, the likes of the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and Britain's National Cyber Security Centre (NCSC) warned of bad actors "exploiting vulnerable routers and opportunistically targeting networks belonging to critical national infrastructure (CNI) globally."

Critical sectors were urged to use the latest version of simple network management protocol (SNMP) to disable disable legacy SNMP instances. This can thwart the efforts of Russian Federal Security Service's (FSB) Center 16, also known as Berserk/Energetic Bear, Static Tundra, and a variety of other aliases. Since 2015 the group has hit organizations in the telecommunications, higher education, and manufacturing sectors, mainly in Ukraine and allied countries.

According to the advisory, Center 16 primarily uses SNMP scans to discover and compromise vulnerable routers, while exploiting historical vulnerabilities in Cisco devices, Cisco’s Smart Install (SMI) feature, and web-portal flaws to take control of network devices.

As revealed by Cisco's Talos research arm in August, the hacker unit has targeted Cisco hardware since 2021 by exploiting an eight-year-old vulnerability in the Smart Install feature of Cisco IOS software and Cisco IOS XE software. Tracked as CVE-2018-0171, the particular vulnerability has been left unpatched by Cisco for these devices due to their obsolete status.

The remote code execution (RCE) vulnerability allows bad actors to either force the affected device to restart, causing a denial-of-service (DoS) status, or to execute an arbitrary code deployment.

CISA's advisory also mentioned CVE-2008-4128 under exploit, while noting an overlap with other networking threats such as Salt Typhoon.

Ian Robinson, CPO at Titania, said the warning confirms that "routers, not just firewalls, are becoming the new front door for attackers."

"What makes this advisory significant is how avoidable it is. The recommended fixes should all be part of network configuration hygiene but are deprioritised. Routers, switches, and the broader network layer are seen as unglamorous, too often overlooked as 'set and forget' infrastructure rather than a critical part of any security strategy and an active, continuously monitored security control. This is precisely what a patient, opportunistic cyber actor from Russian intelligence services, looking to attack critical national infrastructure, is counting on.

"FSB Centre 16 scans the internet for vulnerable routers using default or weak SNMP passwords and legacy protocols ... None of this requires innovation from the attacker - just patience."

Robinson recommended organizations segment networks and adopt least privilege access principles as standard practice to both stop unauthorised lateral movement and limit an attack's blast radius.

Shortly after the public notice, the European Union (EU) imposed sanctions on various individuals and entities linked to Russia’s cybersecurity espionage and disinformation campaigns. Blacklisted entities included Media Land, accused of carrying out malware attacks against states in the EU and beyond, as well as members of pro-Russia hacktivist groups Z-Pentest and Cyber Army of Russia Reborn (CARR).

According to the EU, CARR is linked to the Russian Military Intelligence Agency GRU. It has been associated with various sustained distributed denial-of-service (DDoS) attacks since 2022, as targeting government agencies, financial institutions, media outlets, and critical infrastructure in countries that have supported Ukraine in its war with Russia.