A Global Sweep for Weak Routers

Twelve countries just dropped a coordinated warning about Russian state hackers. Their target? Your router. Specifically, any router still using default or weak Simple Network Management Protocol (SNMP) passwords and community strings.

The joint advisory, released this week, points the finger squarely at the Russian Federal Security Service (FSB) Center 16. This unit is known by many names — Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard, and Static Tundra. Different aliases, same mission: scanning the internet for vulnerable network devices.

And they’re not just looking. They’re actively exploiting what they find.

Who’s at Risk? Pretty Much Everyone Critical

Communications, defense, energy, financial services, government, and healthcare. That’s the list of sectors the advisory flags as most exposed. If you work in any of these fields, this advisory is addressed to you — not as a formality, but as a genuine call to action.

The threat isn’t hypothetical. In late 2025, a coordinated cyber-attack hit Poland’s energy grid. On July 13, the UK and EU officially attributed it to FSB Center 16. The UK government’s statement was blunt: the attack failed, but it could have cut electricity to 500,000 citizens in the middle of winter.

That’s the scale we’re talking about.

Why SNMP Is the Achilles’ Heel

Here’s the technical crux. SNMPv1 and SNMPv2 transmit community strings in plaintext. That means anyone sniffing network traffic can grab them. Once an attacker has a valid community string, they can use Object Identifiers (OIDs) to command the router to copy its configuration and send it off via Trivial File Transfer Protocol (TFTP).

Those stolen configuration files then end up on a virtual private server leased by the threat actor or a compromised FTP server. Game over for network security.

The fix? SNMPv3. It comes with built-in authentication and encryption, protecting management traffic from interception and tampering. The advisory is unambiguous: switch to SNMPv3 now.

Also Patch Your Cisco Devices

Scanning for weak SNMP credentials isn’t the only trick in Center 16’s playbook. They’ve also been known to exploit CVEs in Cisco devices. In 2025, Cisco warned about CVE-2018-0171, a seven-year-old vulnerability in the Smart Install feature. It affects unpatched, often end-of-life Cisco devices — and Center 16 has been actively exploiting it.

The patch has existed since 2018. If you haven’t applied it, you’re leaving a door wide open. If patching isn’t possible, disable Smart Install entirely. There’s no excuse for running unpatched network gear in 2025.

Same Tactics, Different Groups

Interesting note from the advisory: many of the tactics, techniques, and procedures (TTPs) used by Center 16 overlap with other threat actors, including China-linked group Salt Typhoon. That’s a reminder that attribution in cyberspace is messy. But the operational overlap also means that defending against one group often helps against another.

The advisory was co-authored by agencies from Australia, Canada, Czech Republic, Denmark, Estonia, Finland, France, Italy, New Zealand, Poland, Sweden, the UK, and the US. That’s a broad coalition — and it signals how seriously these nations take this specific threat.

Sanctions and the Lumma Stealer Connection

Alongside the advisory, the EU and UK issued a joint sanctions package targeting 24 individuals and entities behind the destructive cyber and hybrid operations. That includes cybercriminals running proxy networks linked to Russian intelligence services.

The UK is also sanctioning individuals behind Lumma Stealer, an info-stealing malware. The UK government says Russia has used stolen credentials from Lumma Stealer to conduct cyber espionage globally, supporting Kremlin objectives.

Here’s a number that should grab your attention: the National Crime Agency reports at least 2,100 Lumma Stealer victims in the UK in just the last six months. That’s not a niche problem — that’s a widespread campaign.

What You Should Do Right Now

Don’t wait for your organization to be the next headline. Here’s a practical checklist based on the advisory:

• Upgrade to SNMPv3 — disable SNMPv1 and v2 entirely if possible.
• Audit your router configurations — change any default or weak community strings immediately.
• Patch CVE-2018-0171 on all Cisco devices, or disable Smart Install.
• Monitor for unauthorized TFTP traffic — this is a common exfiltration method.
• Segment your network to limit lateral movement if a device is compromised.

Router security has never been glamorous. But it’s the frontline of network defense, and Russian state hackers know it. The advisory makes one thing clear: they’re actively scanning for weaknesses right now.

Make sure you’re not an easy target.

What Happened?

Progress Software has told some customers that its flagship enterprise file-sharing service, ShareFile, is facing a “credible external security threat.” The warning, issued on July 10, specifically targets Storage Zone Controllers — the component that gives ShareFile clients private data storage.

The company’s email, later posted on its official ShareFile Community forum, confirmed that access to certain accounts had been temporarily disabled as a precaution. There’s no evidence yet of unauthorized access to any customer data, but Progress is urging users to manually shut down the servers hosting their Storage Zone Controllers.

That’s a strong ask. It essentially tells admins to pull the plug on their own infrastructure while the company investigates.

What Is Storage Zone Controller?

For those unfamiliar, Storage Zone Controller is what makes ShareFile different from a run-of-the-mill cloud drive. Instead of storing everything on Progress’s servers, organizations can keep their data in their own data centers or in a cloud environment they control. That’s a big selling point for regulated industries like healthcare and legal services.

But it also means a vulnerability in this component could expose sensitive data at the customer’s location, not just at Progress’s central cloud.

Timeline of the Incident

Here’s what we know so far, based on the company’s statements and user reports:

• July 10: Progress sends emails to affected customers, warning of the threat and disabling access.
• July 10: Company says users will hear an update within 24 hours.
• July 12 (5 p.m. ET): Progress claims all ShareFile customers with Storage Zone Controllers have been notified that cloud access is restored.
• July 13: Reddit users report three days of silence. The status portal still shows the July 10 update as the latest.

That gap between promise and delivery hasn’t sat well with some users. One Reddit thread from July 13 is full of admins asking the same question: what’s actually going on?

Progress, for its part, said in a statement to Infosecurity that Storage Zone Controllers “must remain turned off while we complete our investigation.” So cloud access is back, but the on-premise piece is still frozen.

Is This Connected to MOVEit?

It’s impossible to talk about Progress Software security without mentioning the elephant in the room: MOVEit Transfer. In 2023, a critical vulnerability in that product was exploited in widespread ransomware attacks that hit hundreds of organizations. The fallout was massive, and it put a spotlight on Progress’s security practices.

Now, some forum participants are speculating that this ShareFile incident could be related to a recently disclosed vulnerability or even a new zero-day. Progress hasn’t confirmed any of that. In fact, the company says it has “not identified any active threat.”

That’s a reassuring line, but it’s also worth remembering that the MOVEit breach initially looked contained too. The company’s history makes it hard to give it the benefit of the doubt.

What Should ShareFile Customers Do?

If you’re running a Storage Zone Controller, here’s the practical advice:

1. Keep it off. Progress has explicitly said controllers must remain powered down until further notice. Don’t rush to reboot.
2. Monitor the status portal. The official ShareFile status page is the best source for updates, even if it’s been quiet lately.
3. Check your logs. Once access is restored, review access logs for any suspicious activity during the window.
4. Talk to your account rep. If you’re a paying customer, you should be getting direct communication. If you’re not, ask why.

It’s also a good moment to review your overall enterprise file sharing security posture. Incidents like this are a reminder that even trusted vendors can be a weak link.

The Bigger Picture

Progress Software has had a rough couple of years on the security front. The MOVEit breach was a black mark that the company has been trying to live down, and now this. It’s not a good look for a vendor that positions itself as a trusted name in secure file transfer.

For CISOs and IT admins, the lesson is familiar but worth repeating: third-party risk is real. If you’re using a service like ShareFile to store sensitive data, you need a contingency plan. That means backups, alternative communication channels, and a clear understanding of what your vendor will do when things go sideways.

Progress says it has launched internal and external security investigations. No timeline has been given for when the full picture will emerge. Until then, the advice is simple: keep those controllers off, and keep an eye on your inbox.

We’ll update this story as more details become available.

For months, two of the world’s most sophisticated cyber espionage operations were quietly working the same beat: the digital backbone of Pakistan’s police forces. One linked to Beijing. The other to New Delhi. Both after the same sensitive data.

New research from SentinelOne‘s SentinelLabs, published July 9, reveals that suspected China- and India-nexus actors ran parallel intrusion campaigns against several Pakistani law enforcement bodies between February 2024 and April 2026. The primary target: Balochistan Police, the province’s main force.

This is a story about espionage, sure. But it’s also a story about what happens when rival nations see the same vulnerable target and decide it’s worth the risk.

What the Attackers Got Access To

The compromised assets weren’t just email accounts or routine administrative systems. These were servers hosting the kind of data that makes intelligence analysts salivate:

• Biometric records and fingerprint databases
• Criminal case files
• Tenant and landlord registrations tied to national identity data
• Police personnel and payroll records
• Stolen vehicle records
• Hotel check-ins linked to identity information
• Citizen complaints, including misconduct reports

One China-nexus actor reportedly planted implants in a portal used by both officers and citizens. The scale is staggering — and the implications for privacy and national security are profound.

Four Clusters, Two Adversaries

SentinelLabs grouped the command and control (C2) activity into four distinct clusters. The technical fingerprints tell a clear story of attribution.

PlugX, ShadowPad and Cobalt Strike — all well-known tools in the Chinese cyber arsenal — point to China-nexus operators. A separate Remcos cluster was tied to a suspected India-nexus actor that Recorded Future tracks as TAG-179, a group that overlaps with what others call Bitter.

Two rivals. Opposite motives. Same battlefield.

Why China Wanted the Data

For China, the likely driver was the safety of its nationals. The China-Pakistan Economic Corridor (CPEC) has poured billions into the region, and Chinese workers have faced repeated deadly attacks there. Some of those attacks were claimed by the Balochistan Liberation Army (BLA), a separatist group that has made targeting Chinese interests a centerpiece of its strategy.

Police data would allow China to assess that threat independently — without relying on Pakistani assurances. It’s a classic intelligence move: verify what your ally tells you, using their own records.

India’s Angle: The Rivalry Next Door

India’s motive is less about protecting citizens and more about the enduring rivalry with Pakistan, in which Balochistan is a recurring flashpoint.

Islamabad has long accused New Delhi of backing the Baloch insurgency — an accusation India denies. The police force holds the record of how Pakistan polices the province. For Indian intelligence, that’s a goldmine of operational insight.

The convergence of these two campaigns isn’t a coincidence. It’s a reflection of how Balochistan has become a geopolitical chessboard where information is the most valuable currency.

The Citizen Portal That Turned Against Its Users

The standout finding was the compromise of the force’s Complaint Management System (CMS), a portal used by both officers and citizens to track complaints. Two variants of an implant named cms_plugin.exe were uploaded in late 2024.

One variant, written in Rust, is a stager that on execution displayed a reassuring message: “Update Complete! Please refresh the page.” It mimicked a routine portal update. Users had no reason to suspect anything was wrong.

The other variant, built in .NET, posed as a component of Chinese vendor Qihoo 360‘s security software. It loaded an AsyncRAT client, giving the attackers remote control over infected machines. Shared code and simplified Chinese strings pointed to a Chinese-speaking developer.

A Structural Risk in Digital Policing

The convergence of these campaigns reflects a deeper problem. Systems that centralize records and services also concentrate intelligence value. Police infrastructure has become intelligence terrain for any capable adversary.

This isn’t just a Pakistani problem. Every country that digitizes law enforcement data creates a similar honeypot. The question is whether the security posture matches the sensitivity of the data.

For Balochistan Police, the answer appears to be no. And when two rival nations both figured that out, the result was a silent war fought over servers and databases — with citizens’ most personal data caught in the crossfire.