FSB Targets Europe’s Unpatched Routers

Somewhere in a block in Sliema, a hotel back office in St Julian's, a clinic in Mosta or a government office near Il-Belt, a router is sitting in a cupboard. It was installed years ago, nobody has touched its firmware since, and it may still accept the password it had when it left the factory. It works, so it disappears from view. That is precisely why Russian intelligence finds it useful.

A joint advisory published this month by the NSA, FBI and intelligence agencies from at least eight European countries named one Russian unit, FSB Center 16, as the actor systematically exploiting these forgotten devices (CISA). The coalition includes France, Italy, Poland, Sweden, Finland, Estonia, Denmark and the Czech Republic (NCSC NZ). This is not being framed as a niche cyber problem. It is being treated as a shared Western exposure, and for a small, highly networked economy like Malta's, that matters.

How the building's floor plan walks out the door

Many routers still have an old remote-management feature switched on. It lets administrators manage equipment from elsewhere on a network. Engineers call it SNMP. Its early versions were designed decades ago and offer almost no real protection. The "password" is a short text string, often left at the factory setting: literally "public" or "private." Anyone scanning the internet can try it (CISA).

Once inside, the attacker can order the router to copy its own configuration file and send it to a server under their control (NSA). That file is the router's notebook. It can show which devices sit on the network, how traffic moves between them, and sometimes where access credentials are stored. The attacker does not just get a foothold. They get a map.

In ordinary terms, the spy keeps trying doors until one opens, copies the floor plan, reads the internal phone list and notices where the keys are kept. Finland's cybersecurity centre put the same point plainly: weakly protected network devices create a route for cyberattacks, and organisations should not leave these remote-control panels visible from the public internet (Kyberturvallisuuskeskus).

The backbone of European economies, exposed

The advisory lists the sectors being targeted: communications, energy, financial services, government, the defence industrial base and healthcare (CISA). In Malta, that list is not abstract. Communications, financial services, public administration and healthcare are concentrated in a small physical and institutional space, where one weak supplier or branch office can sit closer to critical systems than the organisation realises.

German coverage focused on the imbalance: routers and other boundary devices, the equipment sitting between an organisation and the open internet, are often watched less carefully than servers or laptops, even though one loose setting is enough for an attacker to start mapping a network (Handelsblatt, cyberdeutsch.news). Italy's intelligence services AISE and AISI co-signed the advisory (Decode39). Finnish intelligence Supo issued a parallel national warning for companies and critical sectors (Supo).

The risk does not stop with the first victim. A compromised router can become a forwarding address for the attacker. Later hostile traffic can be sent through the victim's network, making it appear to come from a trusted European business. That launders the attacker's presence and makes detection harder for every partner, supplier and client in the chain (AttackIQ).

The fix is boring, and that is the problem

The recommended defences are deliberately ordinary: disable old SNMP versions, move to SNMPv3, which requires proper authentication, change default passwords, restrict remote management to known networks, update firmware, and replace devices that no longer receive patches (NSA). Finland's cybersecurity centre added one more practical measure: collect and retain logs for six to 24 months (Kyberturvallisuuskeskus).

Every item on that list can be done now by an IT team, without waiting for a new EU law, a budget speech or another intelligence briefing. The weakness is priority, not knowledge. A hospital, kunsill lokali, ministry unit or financial services firm may have respectable laptop security while a branch router still carries the password it shipped with in 2018.

That is the pattern about which twenty countries are now warning. Russian state intelligence is not only breaking through sophisticated defences. It is also using the maintenance panels that nobody locked. The operation scales because the same small failure is repeated across thousands of networks.