Router hygiene sounds like the least glamorous topic in cybersecurity. According to the National Security Agency, it is also one of the most consequential — because Russian state actors are still walking through unlocked doors.

The NSA, working with a broad coalition of international partners, has released a Cybersecurity Advisory titled “Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting,” warning device owners about ongoing threats to critical infrastructure networks.

Who Is Doing the Targeting

The advisory names the culprit directly: Center 16 of the Russian Federal Security Service, better known as the FSB.

This is not a new campaign. It is a persistent one, and it continues to succeed for a mundane reason — poorly configured and unpatched networking equipment.

The affected sectors span much of the economy across both US and foreign networks:

• Defense Industrial Base
• Communications
• Energy
• Financial services
• Government facilities
• Healthcare

The Core Message

The NSA and its co-sealing agencies make an argument that may sound almost too simple: basic router hygiene is an effective deterrent against state-level cyber actors.

That is not a claim that fundamentals stop everything. It is a claim that a substantial amount of state-sponsored intrusion depends on organisations failing to do things they already know they should do.

The Recommended Hardening Measures

The advisory lays out five priority actions for organisations:

• Implement Simple Network Management Protocol version 3 (SNMPv3)
• Use strong, unique passwords
• Disable Cisco Smart Install
• Block TFTP, SMI, and SNMP protocols at the firewall
• Upgrade software and firmware images to patch known vulnerabilities

None of these are exotic. All of them are routinely neglected.

Building on Earlier Warnings

The advisory expands considerably on a previous FBI Public Service Announcement, “Russian Government Cyber Actors Targeting Networking Devices, Critical Infrastructure.”

Beyond the hardening checklist, the document details additional tactics, techniques, and procedures used by these actors — giving network defenders a fuller picture of how intrusions actually unfold rather than just a list of boxes to tick.

Device owners and defenders are urged to review the advisory in full and implement both mitigation and remediation actions.

An Unusually Broad Coalition

What stands out about this release is the sheer number of governments attaching their names to it.

Co-sealing agencies include:

• Cybersecurity and Infrastructure Security Agency (US)
• FBI
• Department of Defense Cyber Crime Center
• Australian Signals Directorate’s Australian Cyber Security Centre
• Canadian Centre for Cyber Security
• New Zealand National Cyber Security Centre
• United Kingdom National Cyber Security Centre
• Czech Republic National Cyber and Information Security Agency
• Danish Defence Intelligence Service
• Estonian Foreign Intelligence Service and Information System Authority
• Finnish Defence Intelligence and Security Intelligence Service
• French National Cybersecurity Agency
• Italian External and Internal Intelligence and Security Agencies
• Military Counterintelligence Service of Poland
• Sweden National Cyber Security Centre

That is nearly the entire Western intelligence-sharing apparatus signing a single document about routers.

Why That Matters

Coalitions of this size are not assembled for routine advisories. The breadth of participation signals that this activity is being observed across many countries simultaneously — and that the same weaknesses keep appearing everywhere.

The uncomfortable implication is that the FSB does not need sophisticated zero-day exploits to get inside critical infrastructure. It needs organisations to keep running default configurations, legacy protocols, and unpatched firmware.

The Takeaway

There is a temptation to treat state-sponsored hacking as an unstoppable force — the work of adversaries so capable that defence is futile.

This advisory quietly rejects that framing. The message from a dozen intelligence agencies is that a meaningful share of Russian intrusions could be blocked by disabling a legacy Cisco feature, changing passwords, and installing patches that already exist.

The threat is sophisticated. The entry point usually is not.