US and allied cybersecurity agencies warn that Russian state-sponsored hackers from FSB Center 16 (Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard, Static Tundra) are systematically targeting vulnerable and poorly configured routers and other networking devices to infiltrate critical infrastructure worldwide. The actors scan internet-facing IP ranges for devices using default or weak SNMP credentials, then send SNMP set-requests, often via spoofed IPs, to copy configuration files and exfiltrate them over TFTP or FTP to attacker-controlled servers. They also exploit known Cisco flaws, including CVE-2018-0171 in Smart Install, to gain arbitrary code and command execution. Sectors reported to be at the highest risk include energy, communications, defense industrial base, healthcare, financial services, and government. The advisory follows the disruption of FrostArmada, a separate APT28 campaign that hijacked DNS settings on 18,000 MikroTik and TP-Link SOHO routers to steal Microsoft 365 credentials and OAuth tokens. CTIX Analysts recommend that defenders at high-risk organizations disable Cisco Smart Install, move to SNMPv3, enforce strong unique passwords, block SNMP/TFTP at edge firewalls, restrict management protocols, keep firmware patched, and replace end-of-life devices to reduce exposure.