FSB Center 16: 13 Nations Warn of Russia's Static Tundra Router Espionage Campaign

FSB Center 16 is Russia's Federal Security Service Center for Information Security, Military Unit 71330, the FSB's designated signals intelligence and electronic intelligence collection unit. The Department of Justice indicted three FSB Center 16 officers in 2022 for their roles in a campaign targeting energy sector organizations, making it one of the few Russian state hacking groups with named individuals facing federal charges.

The group's operational history runs from at least 2010 to the present. Western intelligence agencies and private threat researchers have tracked its activities under overlapping names reflecting different analytical perspectives rather than distinct sub-groups. Cisco Talos assigned the designation Static Tundra to this year's advisory activity. CrowdStrike's historical tracking uses Berserk Bear. Dragos and other ICS-focused firms used Dragonfly and Energetic Bear during the 2012-2014 energy sector campaign. The NCSC uses Crouching Yeti. Microsoft Threat Intelligence tracks the group as Ghost Blizzard.

FSB Center 16 occupies a specific role in Russia's offensive cyber hierarchy. The GRU's Sandworm unit (Unit 74455) executes destructive operations, deploying wipers and causing kinetic-equivalent damage. APT28/Fancy Bear (Unit 26165) conducts influence operations and credential theft supporting political objectives. FSB Center 16's mandate is persistent intelligence collection: mapping critical infrastructure networks, reading operational data, and maintaining long-term quiet access that survives routine security reviews.

The December 2025 destructive attack against 30+ Polish wind farms, solar facilities, and heating plants, using malware variants DynoWiper and LazyWiper, marks a documented departure from the intelligence collection mission. The July 2026 advisory cites this expansion as evidence that critical infrastructure targeting by nation-states has reached an operational threshold requiring immediate defensive response.

FSB Center 16's primary exploitation technique requires no custom exploit code and no target-specific research. The attack begins with internet-scale scanning for SNMP-enabled routers accepting default or weak community strings. The community string "public" is the factory default on a significant percentage of Cisco, Juniper, and third-party enterprise networking hardware shipped over the past 20 years.

When a target router is identified with a writable SNMP community, attackers issue an SNMP Set-Request targeting the Cisco CISCO-CONFIG-COPY-MIB at OID 1.3.6.1.4.1.9.9.96. This MIB implements the router's legitimate configuration backup function. The attacker's request instructs the device to copy its running configuration over TFTP to an attacker-controlled server. The device complies because SNMP Set-Requests are authenticated only by the community string, and the community string is "public."

The configuration file that arrives on the attacker's server contains the entire network topology: interface addresses, routing tables, VPN parameters, VLAN configurations, access control lists, and user credentials stored as hash values. Cisco Type 7 and Type 0 passwords are trivially reversible using free online tools. Type 4 passwords use a flawed SHA-256 implementation without a salt and are crackable via rainbow tables. Only Type 8 (PBKDF2-SHA-256) and Type 9 (scrypt) provide meaningful resistance.

The secondary technique exploits CVE-2018-0171, a CVSS 9.8 buffer overflow in Cisco's Smart Install feature on TCP port 4786. Smart Install was enabled by default on Cisco Catalyst switches and IOS XE devices across multiple product generations. The NSA estimated roughly 250,000 devices were exposed at initial disclosure in 2018. End-of-life devices remain unpatched because no patch path exists.

After initial access, attackers create rogue local accounts with Telnet access, weaken TACACS+ logging to reduce SOC visibility, and build GRE tunnels that redirect network traffic through attacker infrastructure for passive signals collection.

CISA Advisory AA26-194A and analysis from Picus Security, Cisco Talos, and AttackIQ document FSB Center 16's techniques against the MITRE ATT&CK framework. The attack chain maps from initial reconnaissance through persistence and collection, with limited technique evolution over 16 years because the underlying vulnerability class, default credentials on network infrastructure, remains unaddressed at scale.

Initial Access and Discovery: T1595.001, T1595.002 (Active Scanning) — internet-scale scanning for SNMP-enabled devices accepting default community strings, using Shodan/Censys-style dataset aggregation. T1602.001 (Data from Configuration Repository: SNMP) — direct extraction of router running-configurations via SNMP Set-Requests to CISCO-CONFIG-COPY-MIB.

Execution and Exploitation: T1190 (Exploit Public-Facing Application) — exploitation of CVE-2018-0171 against TCP/4786. T1569 (System Services) — execution via SNMP-triggered service calls. T1027 (Obfuscation) — SNMP requests originate from spoofed source IPs, exploiting UDP's stateless nature to obscure attacker infrastructure.

Persistence: T1098 (Account Manipulation) — creation of rogue local accounts with Telnet access on compromised routers. T1601 (Modify System Image) — deployment of SYNful Knock firmware implant, providing persistence that survives device reboots and standard remediation attempts.

Credential Access: T1003 (Credential Dumping) — extraction of Type 0, 4, and 7 password hashes from stolen configuration files. T1602.002 (Data from Configuration Repository) — collection of TACACS+ server addresses and shared secrets.

Exfiltration and Collection: T1048, T1071, T1090 — TFTP exfiltration to attacker infrastructure, GRE tunnel construction for passive traffic interception, and proxy infrastructure to obscure origin. Russian APT power grid attacks documented earlier in 2026 used a comparable infrastructure-access pattern, though targeting operational technology networks directly rather than router configuration files.

FSB Center 16's technical indicators span network ports, SNMP object identifiers, firmware implant artifacts, and behavioral signals detectable independent of specific IP addresses, which rotate frequently across the group's proxy infrastructure.

The primary network indicator is any inbound SNMP Set-Request targeting OID 1.3.6.1.4.1.9.9.96 (the CISCO-CONFIG-COPY-MIB namespace) from non-management addresses. Legitimate network monitoring systems do not initiate config-copy operations via SNMP Set from external sources. Any inbound Set-Request to this OID prefix from an unexpected address is a high-fidelity indicator of this specific technique.

The secondary indicator is outbound TFTP traffic (UDP/69) originating from network device IP addresses rather than endpoints or servers. Network devices should not initiate TFTP sessions to internet addresses. Any such session warrants immediate investigation.

TCP/4786 inbound connections from non-management ranges indicate Smart Install exploitation attempts against CVE-2018-0171. In most environments, no external traffic should reach this port.

SYNful Knock, the firmware persistence implant deployed post-compromise, identifies itself through a non-standard HTTP challenge/response backdoor behavior on TCP/80. Cisco Talos published detection signatures in 2015; firmware integrity validation using Cisco's IOS integrity checker remains the authoritative confirmation method since the implant survives reboots.

FSB Center 16 uses leased server infrastructure and proxy chains for TFTP exfiltration destinations. Specific IP addresses from any advisory have a short operational lifespan. Behavioral detection on OID patterns, port activity, and exfiltration events provides more durable coverage than IP-based blocklists.

FSB Center 16's operational history includes three campaign phases with confirmed victim organizations, a DOJ indictment, and an expansion into destructive operations in the months before the July 2026 advisory.

The 2012-2014 Dragonfly/Havex phase infected over 17,000 devices across energy sector organizations in the United States and Europe through a supply chain compromise that trojanized legitimate ICS software installers. The campaign gave the group access to operational technology networks supporting power generation and transmission infrastructure. The FBI assessed in its 2018 follow-up advisory that the group had pre-positioned to cause disruptions to U.S. electrical distribution.

Wolf Creek Nuclear Operating Corporation in Kansas confirmed a business network compromise attributed to FSB Center 16, the only publicly named U.S. nuclear facility victim. The group stopped short of operational network access in that incident, consistent with the intelligence collection mission.

The 2022 DOJ indictment named three FSB officers from Military Unit 71330: Pavel Akulov, Mikhail Gavrilov, and Marat Tyukov. All three face federal charges related to the energy sector campaign. All three remain in Russia and are outside U.S. legal jurisdiction.

The December 29, 2025 Polish incident marks the documented shift toward destructive operations. Over 30 wind farm, solar energy, and district heating facilities in Poland were hit with DynoWiper and LazyWiper, destructive malware variants designed to overwrite disk data and prevent recovery. The Polish ABW attributed the attack to FSB Center 16. This is the first confirmed destructive deployment by a unit previously associated exclusively with intelligence collection, and it validates the July 2026 advisory's elevated warning posture.

No CVE-specific Sigma rule exists for CVE-2018-0171 (Cisco Smart Install RCE) in the current SigmaHQ stable corpus. The vulnerability has been patched since 2018 and most active Sigma development targets post-exploitation behaviors rather than the initial exploit delivery. The two rules below target the behaviors FSB Center 16 produces after gaining access: SNMP OID reconnaissance captured via honeypot telemetry, and Cisco device 802.1X authentication disablement, a post-compromise configuration change the group makes to weaken network access controls.

Deploy the SNMP OID rule to any OpenCanary honeypot node configured with SNMP service enabled. Deploying an SNMP-capable canary on your management VLAN with a decoy community string will catch scanner activity including FSB Center 16's initial reconnaissance pass. The Cisco Dot1x rule requires Cisco AAA logging forwarded to your SIEM; it fires when any actor disables 802.1X port authentication on a Cisco device, which maps directly to FSB Center 16's post-compromise persistence technique of weakening network access controls.

Use sigma-cli to convert the YAML below to Splunk SPL, Microsoft Sentinel KQL, or Elastic ESQL. Supplement these rules with custom detections for inbound SNMP Set-Requests to OID 1.3.6.1.4.1.9.9.96 and outbound TFTP sessions from network device IPs, which are the highest-fidelity behavioral indicators for this specific threat.

Detection for FSB Center 16 activity requires log telemetry from network devices that most organizations do not collect by default. Routers treated as set-and-forget infrastructure rarely export SNMP request logs, TACACS+ authentication events, or NetFlow data to a SIEM. Closing that visibility gap is the first defensive requirement.

SNMP monitoring platforms will show Get-Requests from your NMS continuously. A Set-Request to OID 1.3.6.1.4.1.9.9.96 from any address outside your management-plane CIDR is an anomaly that should generate a high-severity alert. The same logic applies to outbound TFTP sessions from router IP addresses: legitimate management tasks do not trigger TFTP to internet destinations.

TACACS+ logging shows authentication events against network devices. Watch for new local account creation (a gap in TACACS+ events followed by successful Telnet logins) and for configuration changes that weaken logging itself. Attackers modify TACACS+ settings early in post-compromise to reduce the fidelity of logs returned to the SOC.

NetFlow from perimeter routers provides a passive record of traffic patterns. A new GRE tunnel to an external address that wasn't present in yesterday's baseline is a significant anomaly. GRE tunnels for site-to-site VPN are expected. GRE tunnels to non-RFC1918 addresses not in your approved VPN peer list are not.

The seven remediation steps below close the primary attack paths documented in AA26-194A. Organizations in the six targeted sectors should treat these as emergency actions, not scheduled maintenance.