What Happened
On July 13, 2026, the Canadian Centre for Cyber Security (CCCS) joined the U.S. National Security Agency (NSA), CISA, and the FBI, along with partners from Australia, the United Kingdom, New Zealand, Estonia, Finland, France, the Czech Republic, and Italy, in releasing joint cybersecurity advisory AA26-194A: “Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting.”
The advisory attributes the attacks to hackers affiliated with FSB Center 16, the same unit linked to previous campaigns against Western critical infrastructure. The threat actors exploit minimally secured, internet-facing routers — targeting default credentials, known unpatched firmware vulnerabilities, and exposed management interfaces — to establish persistent footholds inside critical infrastructure networks. From compromised routers, attackers pivot laterally into operational technology (OT) control systems, SCADA environments, and internal enterprise networks.
The advisory includes specific indicators of compromise, recommended network segmentation controls, and hardening steps for consumer and enterprise-grade routers. Organizations are instructed to disable remote management interfaces not in active use, rotate all default credentials, apply firmware patches immediately, and implement logging on all edge devices.
Why This Matters for Canadian Organizations
Canada’s direct inclusion in this advisory is significant. The CCCS co-signed AA26-194A alongside law enforcement and intelligence partners from nine other countries, reflecting an active assessment that Canadian critical infrastructure is a target in this campaign. The sectors most at risk — energy, water, transportation, and telecommunications — are precisely those covered by Bill C-26, Canada’s critical cyber systems protection legislation. Any Canadian organization operating in these sectors, or providing IT services to organizations in them, should treat this advisory as a direct warning.
The router-targeting methodology is especially dangerous for smaller Canadian municipalities, utilities, and healthcare organizations that run legacy networking equipment on extended maintenance windows. A compromised router is difficult to detect with standard endpoint security tools and gives attackers a long-duration foothold before any lateral movement begins. The same advisory published by Canada’s U.S. and European counterparts identified that threat actors in this campaign maintained access for months before detection.
Under PIPEDA and the forthcoming critical infrastructure reporting requirements under Bill C-26, a breach that originates from a compromised network device carries the same notification obligations as any other incident. CCCS incident reporting should be treated as a parallel obligation for operators in designated critical infrastructure sectors.
What to Do
Security teams should audit all internet-facing routers and network edge devices this week. Disable web-based management interfaces unless actively required. Replace any default credentials on all network equipment — consumer and enterprise alike. Apply all available firmware updates. Where routers are end-of-life and no longer receiving security updates, replace them. Implement network segmentation so a compromised edge device cannot directly reach OT environments or sensitive internal systems. Review logs for the indicators of compromise listed in AA26-194A, available at CISA’s advisory page. The CCCS version of the advisory is available at cyber.gc.ca.
Source: BleepingComputer
