US and Allies Warn Russian APTs Are Targeting Critical Infrastructure Routers
Summary
A joint advisory says Russian FSB Center 16 actors target poorly secured routers at critical infrastructure organizations, using SNMP to copy device configurations and exploiting known Cisco flaws. Agencies recommend hardening network-device access and updating firmware
Key points
- Agencies from the US and 12 allied countries warn that Russian FSB Center 16 actors are targeting network devices at critical infrastructure organizations.
- The activity spans communications, defense, energy, finance, government, and healthcare sectors.
- The advisory says actors use proxies to send SNMP set-requests that copy device configurations and transfer them, usually over TFTP, to remote servers.
- The actors have also been observed exploiting Cisco vulnerabilities CVE-2008-4128 and CVE-2018-0171, which can enable arbitrary code or command execution.
- Recommended defenses include disabling Cisco Smart Install and SNMPv1/v2, using SNMPv3 with modern encryption, securing device credentials, and monitoring local-account logins.
- Agencies also advise restricting SNMP OIDs and management protocols, limiting external communications at network edges, and updating device software and firmware.
Article Details
- Event Type
- Joint government advisory warning of Russian state-sponsored cyber activity targeting networking devices.
- Impact
- The activity targets critical infrastructure organizations worldwide. The agencies report scanning poorly secured devices, mainly routers, using SNMP requests to copy device configurations and transfer them, usually over TFTP, to a VPS or compromised FTP server. They also report exploitation of vulnerabilities in Cisco devices that can enable arbitrary code and command execution. No specific victim, confirmed operational disruption, or confirmed data loss is reported.
MITRE ATT&CK
CVE
CVE-2008-4128Additionally, the threat actors have been observed exploiting known vulnerabilities in Cisco devices, including CVE-2008-4128 and CVE-2018-0171, which lead to arbitrary code and command execution.CVE-2018-0171Additionally, the threat actors have been observed exploiting known vulnerabilities in Cisco devices, including CVE-2008-4128 and CVE-2018-0171, which lead to arbitrary code and command execution.
Threat Actors
Berserk BearThe advisory names Berserk Bear among Russian FSB Center 16 threat actors seen engaging in the reported attacks.Crouching YetiThe advisory names Crouching Yeti among Russian FSB Center 16 threat actors seen engaging in the reported attacks.DragonflyThe advisory names Dragonfly among Russian FSB Center 16 threat actors seen engaging in the reported attacks.Energetic BearThe advisory names Energetic Bear among Russian FSB Center 16 threat actors seen engaging in the reported attacks.Ghost BlizzardThe advisory names Ghost Blizzard among Russian FSB Center 16 threat actors seen engaging in the reported attacks.Salt TyphoonThe agencies say some TTPs in the reported activity overlap with activity by Salt Typhoon; they do not attribute the router attacks to this group.Static TundraThe advisory names Static Tundra among Russian FSB Center 16 threat actors seen engaging in the reported attacks.
Vendors
Industries
CommunicationThe activity targets critical infrastructure organizations across the communication, defense industrial base, energy, financial, government, and healthcare and public health sectors.Defense industrial baseThe activity targets critical infrastructure organizations across the communication, defense industrial base, energy, financial, government, and healthcare and public health sectors.EnergyThe activity targets critical infrastructure organizations across the communication, defense industrial base, energy, financial, government, and healthcare and public health sectors.financialThe activity targets critical infrastructure organizations across the communication, defense industrial base, energy, financial, government, and healthcare and public health sectors.GovernmentThe activity involves scanning for poorly secured devices, mainly routers, for exploitation, government agencies from the US, Australia, Canada, the Czech Republic, Denmark, Estonia, Finland, Italy, New Zealand, Poland,Healthcare and public healthThe activity targets critical infrastructure organizations across the communication, defense industrial base, energy, financial, government, and healthcare and public health sectors.