FSB exploits Europe’s router defaults

Somewhere in an office block, clinic or council building, a router is sitting in a cupboard doing the job it was bought to do. It was installed years ago, its software has not been touched in ages, and the factory password still works. Because the internet connection is grand, nobody thinks about it. For Russian intelligence, that neglect is useful.

A joint advisory published this month by the NSA, FBI and intelligence agencies from at least eight European countries names FSB Center 16, a Russian security service unit, as the actor systematically exploiting these forgotten devices (CISA). France, Italy, Poland, Sweden, Finland, Estonia, Denmark and the Czech Republic are among the coalition (NCSC NZ). The warning treats poor router maintenance as a shared Western weakness, not a local IT nuisance.

How the building's floor plan walks out the door

Many routers still have an old remote management feature switched on, allowing administrators to control equipment from elsewhere on a network. Engineers know it as SNMP. The early versions were designed decades ago and offer little real security. Their "password" is often a short text string left at the factory setting: literally "public" or "private." Anyone scanning the internet can try it (CISA).

Once inside, the attacker can tell the router to copy its configuration file and send it to a server they control (NSA). That file is the router's notebook: which devices are on the network, how traffic moves between them, and sometimes where credentials are stored. The result is an internal map of the organisation, and often a route further in.

It is the digital version of trying doors until one opens, copying the floor plan, reading the internal phone list and noticing where the keys are kept. Finland's cybersecurity centre put it plainly: weakly protected network devices create a route for cyberattacks, and organisations should not leave these remote-control panels visible to the public internet (Kyberturvallisuuskeskus).

The backbone of European economies, exposed

The advisory lists the sectors being targeted: communications, energy, financial services, government, the defence industrial base and healthcare (CISA). That is the basic operating system of any European economy, Ireland's included.

German coverage drew attention to the imbalance. Boundary devices, the routers and related equipment sitting between an organisation and the open internet, often receive less scrutiny than servers or laptops. Yet one poor setting can be enough for an attacker to begin mapping a network (Handelsblatt, cyberdeutsch.news). Italy's intelligence services, AISE and AISI, co-signed the advisory (Decode39). Finland's Supo issued a parallel national warning for companies and critical sectors (Supo).

The damage does not always stop with the first victim. A compromised router can be used as a forwarding address for later hostile traffic, making it appear to come from a trusted European business. That masks the attacker's presence and makes detection harder for partners, suppliers and customers across the chain (AttackIQ).

The fix is boring, and that is the problem

The recommended defences are deliberately plain: disable old SNMP versions, move to SNMPv3, which requires proper authentication, change default passwords, restrict remote management to known networks, update firmware, and replace devices that no longer receive patches (NSA). Finland's cybersecurity centre added another basic discipline: collect and retain logs for six to twenty-four months (Kyberturvallisuuskeskus).

None of this requires a new law or another intelligence briefing. An IT team can start on it today. The gap is priority. A hospital, local authority or medium-sized company may have decent security on laptops while a branch-office router still accepts the password it had when it left the box in 2018.

That is the pattern twenty countries are now warning about. Russian state intelligence is not always breaking through advanced defences. Often it is using maintenance openings that were never closed. The operation scales because the same small failure has been repeated across thousands of networks.