On July 13, 2026, the NSA, CISA, the FBI and the Pentagon’s Cyber Crime Center, along with cyber agencies in the UK, Australia, Canada and New Zealand, published a joint advisory warning that state-sponsored hackers are breaking into business routers by scanning for weak or default passwords. The advisory names a Russian intelligence unit tracked as FSB Center 16 as the actor and focuses on critical infrastructure, but the same scanning tools sweep every router on the internet, including the one sitting in a Naples medical office or a Fort Myers accounting firm. Router security stops being a big-company problem the moment your router has a factory-default password on it.
Key takeaways
- A joint NSA/CISA advisory (AA26-194A) confirms nation-state actors are actively targeting poorly configured routers and network switches.
- The attackers rely on default or weak SNMP passwords, outdated firmware, and a legacy Cisco feature called Smart Install.
- Small businesses are not the named target of this specific campaign, but they run the same vulnerable equipment and get caught by the same automated scans.
- Most of the fixes take under an hour: change default credentials, disable SNMP if you don’t use it, and turn off remote management you don’t need.
- Router security is infrastructure hygiene, not a one-time project. It needs a place on your regular IT maintenance checklist.
What does the advisory actually describe?
The NSA’s advisory document describes attackers scanning the internet for routers still using default or common SNMP community strings, the equivalent of a password for older network management protocols. Once in, they copy the device’s configuration file, which often contains other passwords and network diagrams, and pull it off the device using TFTP, an old file transfer protocol with no built-in security. Investigators also found the group exploiting Cisco’s Smart Install feature and at least one Cisco vulnerability that was serious enough to get added to CISA’s Known Exploited Vulnerabilities catalog the same week the advisory came out.
Why would this matter to a small business in Southwest Florida?
The named targets are communications, energy, healthcare, financial services, defense, and government networks. If none of that describes your business, it’s tempting to skip this one. But the technique doesn’t check industry codes. Automated scanners look for open ports and default logins across the entire internet, not just inside defense contractor networks. A dentist’s office router or a marina’s guest network can get swept up in the same scan simply because it answers on the same ports with the same default settings. Attackers who land on a small business network use it to pivot toward larger partners or to steal what data is there. None of that requires the business to be the intended target.
Is your equipment configured the way the advisory describes?
Most small businesses don’t manage their own routers day to day, which means most owners genuinely don’t know the answer. A few questions worth asking your IT provider this week: Has the default admin password on every router, switch, and firewall been changed since it was installed? Is SNMP turned on, and if so, is it still using the factory community string of ‘public’ or ‘private’? Is remote management reachable from the open internet, or only from inside the network? Is the firmware current, or has it been years since anyone logged in to check? If your provider can’t answer these off the top of their head, that’s itself useful information.
What should you actually check this week?
You don’t need a security overhaul to close most of this gap. Start with an inventory: every router, switch, and firewall on the network, who manages it, and when it was last updated. Change any password still set to the manufacturer default, including on equipment installed years ago. Turn off SNMP entirely if nothing in the office uses it for monitoring, and if it is in use, replace the default community string with a unique one. Disable remote administration from outside the network unless there’s a documented reason to keep it on. These steps overlap with what we cover in our guide to spotting an aging, unsupported network, since old gear nobody has logged into in years is exactly what this advisory describes.
How does this tie into your broader security posture?
Router hardening is one piece of a bigger pattern we’ve seen with other vendor security bulletins this year, including the recent remote desktop warnings affecting small offices. In both cases, the fix is finding equipment that still has default settings from the day it was installed and locking it down. The businesses that get hit hardest tend to be the ones where nobody owns that checklist, not the ones lacking budget.
Frequently asked questions
Does this advisory mean my small business was specifically targeted?
No. The advisory names critical infrastructure sectors as the primary targets of this specific campaign. Small businesses face risk from the same techniques being used broadly across the internet, not from being personally targeted by this group.
What is SNMP and why does it matter here?
SNMP (Simple Network Management Protocol) is an older protocol used to monitor and manage network equipment. Many devices ship with default passwords, called community strings, that are rarely changed after installation, which is exactly what the advisory says attackers are scanning for.
How do I know if my router still has default settings?
Check the admin login page against the manufacturer’s default credentials listed in the device manual, and check whether SNMP is enabled with a community string of ‘public’ or ‘private.’ If you’re not sure how to check, ask whoever manages your network to walk through it with you.
Is this a one-time fix or an ongoing task?
Ongoing. New devices get added, firmware needs updates, and settings can drift over time. Router and firewall configuration should be part of a recurring IT maintenance review, not a one-off cleanup.
If it’s been a while since anyone checked the router and firewall settings on your network, we’ll do it for free. Contact SWFIT for a 15-minute network security review and we’ll tell you plainly what needs attention.
SWFIT
