kyber.today

daily cyber × ai intelligence

← threat actors

threat actor · not yet in the cluster map

fsb-center-16

2 stories · 2 in the wild · July 14, 2026 – July 18, 2026

evidence: 2 observed

how they got in

  • edge device 1 · Jul 18
  • exposed service 1 · Jul 14

sectors

  • critical infrastructure 2 · Jul 18
  • energy 1 · Jul 14

geography

  • finland 1 · Jul 18
  • russia 1 · Jul 18

techniques

  • exploitation 1 · Jul 14

attack phases seen

  • Initial access 2 · Jul 18
  • Reconnaissance 1 · Jul 18

what we reported, newest first, grouped by story

Jul 14 – July 18, 2026 · 2 reports

  • Finland's Supo warns of a multi-year Russian FSB campaign against critical infrastructure, attributed to the FSB's 16th Center, hunting internet-exposed legacy SNMP and Cisco Smart Install devices — of which the NCSC-FI counted only ~20 in Finland (Yle). It aligns with the joint allied advisory on FSB Center 16 router compromises reported last week (earlier coverage). · Jul 18 · observed · via edge device · Threat Activity
  • The US and eight allies issued a joint advisory (AA26-194a) warning that FSB Center 16 is opportunistically compromising poorly configured routers worldwide via SNMP and Cisco flaws, and CISA added the exploited Cisco IOS vulnerability to its KEV catalog — the technical follow-through to this week's first joint EU/UK cyber sanctions over the Poland grid attack (earlier coverage). Recommended defenses include disabling Smart Install, hardening SNMP, and firmware updates. CISA, BleepingComputer · Jul 14 · observed · via exposed service · Threat Activity