iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
U.S. agencies warn that Russia’s FSB Center 16 continues to exploit vulnerable or poorly configured networking devices to access networks. The NSA’s July 13, 2026 guidance urges organizations to harden routers and other network equipment; the FBI’s earlier public warning describes device configuration files collected and altered during intrusions.
What federal agencies warned about
In a July 13, 2026 announcement, the National Security Agency said Russia’s Federal Security Service (FSB) Center 16 continues to exploit vulnerable and poorly configured networks. The activity has affected U.S. and foreign networks associated with the Defense Industrial Base, communications, energy, financial services, government facilities, and healthcare. The announcement was issued with CISA, the FBI, and international partners. Read the NSA announcement and its linked advisory.
The agencies identify affected sectors, but that does not establish that every organization in those sectors has been breached. The NSA announcement gives no named victim total or numerical estimate of compromises.
Which devices and activity are implicated
The FBI’s August 20, 2025 public service announcement described Russian government actors exploiting Simple Network Management Protocol (SNMP) and end-of-life networking devices running an unpatched Cisco Smart Install vulnerability, CVE-2018-0171. The FBI said that during the preceding year it detected collection of configuration files for thousands of networking devices associated with U.S. entities across critical-infrastructure sectors. It also reported that some vulnerable devices had configuration files changed to enable unauthorized access, which was used for reconnaissance inside victim networks. Read the FBI public service announcement.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
“Thousands” is the FBI’s public description; its notice does not give a more precise count. This figure refers to configuration files collected, not a confirmed number of organizations or successful breaches.
What network defenders should do
The NSA’s July 2026 announcement lists these router-hygiene measures. Consult the full advisory linked from the announcement for implementation context.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
- Implement SNMPv3.
- Use strong, unique passwords.
- Disable Cisco Smart Install.
- Block TFTP, SMI, and SNMP protocols at the firewall.
- Upgrade software and firmware images to patch vulnerabilities.
These are agency recommendations for organizations defending network equipment. Apply them with the equipment’s supported configuration and your network’s operational requirements in mind.
How this warning differs from other Russia-linked advisories
Federal agencies have issued separate warnings about other Russian-linked actors and activity. Similar references to critical infrastructure do not mean the advisories describe one campaign. The actor, access path, observed activity, and recommended mitigations differ.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
| Advisory | Actor and target | Activity described | Mitigations cited |
|---|---|---|---|
| NSA and partners, July 13, 2026; FBI, August 20, 2025 | FSB Center 16; network devices, including devices exposed through SNMP or running Cisco Smart Install | Collection and, in some cases, modification of device configuration files; reconnaissance in victim networks | SNMPv3, strong unique passwords, disable Cisco Smart Install, firewall blocks for TFTP, SMI, and SNMP, and software and firmware updates |
| FBI, CISA, NSA, and partners, September 5, 2024 | GRU Unit 29155; global targets | Cyber operations for espionage, sabotage, and reputational harm, assessed to have occurred since at least 2020 | Routine system updates, network segmentation, and phishing-resistant MFA for externally facing accounts—especially webmail, VPN, and accounts accessing critical systems |
| NSA, FBI, and others, December 9, 2025 | Pro-Russia hacktivist groups including CARR, Z-Pentest, NoName057(16), and Sector16; OT control devices | Opportunistic infiltration through inadequately secured VNC connections, with potential effects on water and wastewater, food and agriculture, and energy. Agencies said groups often sought notoriety and had also damaged vulnerable infrastructure. | See the advisory for its guidance; the cited announcement describes the VNC access path and affected operational technology |
The September 2024 joint advisory concerns GRU Unit 29155, not FSB Center 16. Read the joint advisory on Russian military cyber actors. The December 2025 warning concerns pro-Russia hacktivists using VNC to reach operational technology, not the FSB Center 16 router activity. Read the NSA announcement on pro-Russia hacktivist groups.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Where to report a suspected intrusion
The FBI’s 2025 notice advises reporting suspected Russian FSB intrusion to a local FBI field office or the Internet Crime Complaint Center (IC3). Before filing with IC3, it recommends evaluating routers and other networking devices for configuration changes or malware, then including what you find in the report. The FBI notice includes the reporting guidance.
Quick Recap
Rank #4
- Runs UniFi Network for full-stack network management
- Manages 30+ UniFi Network devices and 300+ clients
- 1 Gbps routing with IDS/IPS
- Multi-WAN load balancing
- 0.96" LCM status display
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
