FSB Center 16 Is Hunting Your Home Router — And CISA Wants You to Act Like It

What a "joint advisory" is (and why it matters)//

When FBI, CISA, NSA, and international partners (here including DC3) put their names on one document, it's not a press release. It's a case where multiple agencies independently saw the same actor and decided the public needed the intel. Joint advisories are where the named TTPs live — the specific tactics, techniques, and procedures that agencies observed in the wild.

This one — AA26-194A, "Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting" — builds on a decade-plus FBI Public Service Announcement about the FSB Center 16 cyber operation.

FSB Center 16 in one paragraph//

Center 16 is a Russian Foreign Intelligence Service unit with more than ten years of tracked activity. Their pattern:

• Target network devices — not just enterprise gear, but consumer and home networking devices too
• Get persistent, low-footprint access — a foothold on your edge router is a beachhead into everything behind it
• Move laterally — from the router into internal hosts, then into whatever's interesting

The key insight: they don't always go after your crown first. They go after your front door, because the front door is easier and the crown is behind it.

Why "just a router" is the worst label//

A home router has the worst possible combination of properties for a defender:

• It's always on and always connected
• It often runs old firmware that rarely gets updated
• It frequently exposes an admin interface (sometimes to the WAN, on purpose)
• It sits between the attacker and everything else

In other words, the device you think of as "just plumbing" is the one device an attacker needs to touch to reach your whole network. That's the entire reason a nation state bothers with it.

What the advisory is telling you to do//

The "router hygiene" guidance is the actionable part. In plain English, the recurring themes are:

1. Update firmware — and don't assume "it works, don't touch it."
2. Reduce the exposed surface — no remote management to the WAN unless you truly need it.
3. Harden the admin interface — strong unique credentials, ideally MFA.
4. Segment — isolate IoT and guest traffic from your real devices.
5. Verify you're not being watched — look for unexpected admin pages, rogue SSIDs, and services you don't remember enabling.