FSB unit exploits default passwords on European routers

Somewhere in your building, a router sits in a cupboard. It was installed years ago, runs firmware nobody has updated, and still accepts its factory password. It works, so nobody touches it. That invisibility is what makes it useful to Russian intelligence.

A joint advisory published this month by the NSA, FBI and intelligence agencies from at least eight European countries named a specific Russian unit, FSB Center 16, as responsible for systematically exploiting these forgotten devices (CISA). The coalition includes France, Italy, Poland, Sweden, Finland, Estonia, Denmark and the Czech Republic (NCSC NZ). The warning is multinational, and it treats router hygiene as a shared Western exposure.

How the building's floor plan walks out the door

Many routers still have an old remote-control feature switched on, one that lets administrators manage equipment from across a network. Engineers call it SNMP. Its original versions, designed decades ago, have almost no security. The "password" is a short text string, often left at the factory default: literally the word "public" or "private." Anyone scanning the internet can guess it (CISA).

Once someone gets in, they tell the router to copy its own configuration file and send it to a server they control (NSA). Think of that file as the router's notebook: which devices exist on the network, how traffic moves between them, and sometimes where access credentials are stored. The attacker gets an internal map of the organization and, often, keys to move deeper.

A spy tries doors until one is unlocked, photocopies the building's floor plan, reads the internal phone list and spots where the keys are kept. Finland's cybersecurity centre put it in practical terms: weakly protected network devices open a route for cyberattacks, and organizations should not leave these remote-control panels visible to the public internet (Kyberturvallisuuskeskus).

The backbone of European economies, exposed

The advisory lists targeted sectors: communications, energy, financial services, government, the defence industrial base and healthcare (CISA). That reads like the backbone of any European economy.

German coverage highlighted the asymmetry: routers and similar boundary devices, the equipment sitting between an organization and the open internet, are monitored less carefully than servers or laptops, even though a single misconfiguration is enough for an attacker to start mapping a network (Handelsblatt, cyberdeutsch.news). Italian intelligence services AISE and AISI co-signed the advisory (Decode39). Finnish intelligence Supo issued a parallel national warning for companies and critical sectors (Supo).

The risk extends beyond the first victim. A compromised router can become a forwarding address for the attacker: later hostile traffic is routed through the victim's network, so it looks as if it comes from a trusted European business. That launders the attacker's presence and complicates detection for every partner and supplier in the chain (AttackIQ).

The fix is boring, and that is the problem

The recommended defences are deliberately unglamorous: disable old SNMP versions, upgrade to SNMPv3 (which requires real authentication), change default passwords, restrict remote management to known networks, update firmware, and replace devices that no longer receive patches (NSA). Finland's cybersecurity centre added: collect and retain logs for six to twenty-four months (Kyberturvallisuuskeskus).

Every item on that list is something an IT team can do now, without new regulation or intelligence briefings. The gap is priority, not knowledge. A hospital or municipal office may run excellent security on laptops while a branch-office router still carries the password it shipped with in 2018.

That is the pattern twenty countries are warning about. Russian state intelligence is not breaking through advanced defences. It is walking through maintenance hatches that were never locked. The espionage scales because the same small maintenance failure repeats across thousands of networks.