{"id":16460,"date":"2026-07-14T01:53:54","date_gmt":"2026-07-14T01:53:54","guid":{"rendered":"https:\/\/newestek.com\/?p=16460"},"modified":"2026-07-14T01:53:54","modified_gmt":"2026-07-14T01:53:54","slug":"governments-to-enterprises-improve-your-router-security-hygiene","status":"publish","type":"post","link":"https:\/\/newestek.com\/?p=16460","title":{"rendered":"Governments to enterprises: Improve your router security hygiene"},"content":{"rendered":"
\n
\n
\n
\n
\n
\n
<\/div>\n<\/section>\n

Global security agencies say enterprises must clean up their act as Russian government-sponsored attackers exploit weaknesses in routers.<\/p>\n

According to a new multinational cybersecurity advisory<\/a>, cyberattackers continue to exploit inadequately-protected and\/or poorly-configured network devices via age-old tactics. Threat actors scan for weakened devices, typically routers, allowing them to \u201copportunistically\u201d compromise critical infrastructure networks, according to the bulletin from 19 federal agencies across North America, the UK, Europe, and Australia.<\/p>\n

They then transfer configuration files to servers they control. These files, containing plaintext or weakly-encoded information like credentials, or details about the organization\u2019s network, hold most of the potential value, noted Seva Ioussoufovitch<\/a>, a senior research analyst at Info-Tech Research Group.<\/p>\n

\u201cIt might sound simple, but this tactic has been exploited for well over a decade, and is clearly still effective,\u201d he said.<\/p>\n

How SNMP attacks work<\/h2>\n

To begin their attack, state-sponsored cybercriminals send requests via the standard Simple Network Management Protocol (SNMP) framework that supports device-network information exchange, which allows them to scan for weak, insecure devices still using older SNMPv1 or SNMPv2 protocols that accept common or default \u201ccommunity strings\u201d for authentication. These strings are typically shared passwords, with predictable, public defaults that might have been left untouched by admins. Additionally, many of these devices may remain in their basic router configurations.<\/p>\n

Using spoofed IP addresses, threat actors instruct SNMP agents running on these devices to copy their configurations to a file (typically \u201cconfig.bkp\u201d or \u201coutput.txt\u201d), then transfer that file to virtual private servers (VPSs) that they control. In addition, cybercriminals are exploiting common vulnerabilities and exposures<\/a> (CVEs) in Cisco devices, as well as in the Cisco\u2019s Smart Install (SMI) tool.<\/p>\n

Actors have exploited, at the very least, CVE-2018-0171<\/a> (published in 2018) and CVE-2008-4128<\/a> (published in 2008), according to the bulletin. Both of these targeted Cisco routers<\/a>, giving remote, unauthenticated attackers the ability to execute arbitrary code, take unauthorized actions, or cause a denial of service (DoS).<\/p>\n

Notable groups using this method are known to the security community as \u201cBerserk Bear,\u201d \u201cCrouching Yeti,\u201d \u201cDragonfly,\u201d \u201cEnergetic Bear,\u201d \u201cGhost Blizzard,\u201d and \u201cStatic Tundra.\u201d According to the bulletin, the industries most vulnerable to Russian state-sponsored cyber actors include communications, energy, financial services, defense industrial bases, healthcare and public health facilities, and government services and facilities.<\/p>\n

A set-and-forget approach, even in 2026<\/h2>\n

The problem with router hygiene is that devices are susceptible to a \u201cconfluence of typical enterprise shortcomings\u201d when it comes to operationalizing security, noted Info-Tech\u2019s Ioussoufovitch.<\/p>\n

\u201cMany organizations still take a set-it-and-forget-it approach to routers, and don\u2019t track them like they would an endpoint,\u201d he said.<\/p>\n

Compounding this risk is the fact that routers are typically critical to business continuity, which increases the necessity of keeping their security up-to-date. To make things worse, in some cases, it might also be unclear who\u2019s in charge of device security. \u201cSecurity points to the network team and they\u2019re pointing right back at security,\u201d Ioussoufovitch noted.<\/p>\n

As well, many organizations continue to rely on legacy hardware that may be unsupported, but that the business is unwilling to replace.<\/p>\n

Ultimately, Ioussoufovitch said, \u201cnetwork security just doesn\u2019t seem to be receiving the same amount of attention as the usual areas of focus (like endpoints).\u201d<\/p>\n

Recommendation: Move away from older protocols and devices immediately<\/h2>\n

Specifically, the agencies urged security teams and network admins to upgrade to SNMPv3, enforce secure passwords, disable Cisco Smart Install, and block SNMP and common file transfer methods \u201cat the firewall.\u201d<\/p>\n

Enterprises should immediately disable SNMPv1 and SNMPv2, which are \u201clegacy protocols and should no longer be needed on current devices.\u201d In instances where they are still deemed necessary, shift from default settings to grant read-only access (no read-write access).<\/p>\n

SNMPv3 should be employed with authPriv<\/em> configured to the \u201cmost modern encryption standard,\u201d the bulletin advised. SNMPv3 adds strong authentication and data encryption unavailable in previous versions, and has more securely encoded parameters to authenticate and encrypt data.<\/p>\n

\u201cMoving to SNMPv3, which offers stronger authentication and encryption, is a clear, actionable step security teams need to prioritize now,\u201d Ioussoufovitch agreed.<\/p>\n

The government agencies urged enterprises to use strong, unique passwords for local accounts on network devices, and to monitor for unusual credentials that do not match standard naming conventions, or misconfiguration in logs or intrusion detection systems (IDS). Networks should support multi-factor authentication (MFA), and admins should enforce allow lists for management protocols like SNMP.<\/p>\n

Additionally, enterprises should update network device software, retire end-of-life devices, and disable Cisco Smart Install on all machines once initial configuration is complete, as this introduces serious security issues<\/a> when it inadvertently remains enabled, the agencies said.<\/p>\n

Network security must improve across the board<\/h2>\n

The advisory is a signal that enterprises may be underinvesting in network security, noted Ioussoufovitch. Admins and security leaders should be asking these questions:<\/p>\n