Joint Advisory Urges Router Hardening Against Russian FSB Center 16 Activity
Summary
A multinational advisory says Russian FSB Center 16 actors target exposed, poorly configured routers using SNMP and, at times, Cisco vulnerabilities. It urges SNMPv3, restricted management access, disabling Smart Install, and patching.
Key points
- The advisory says actors scan internet-facing routers for SNMP agents that accept default or common community strings.
- Spoofed SNMP Set-Requests can prompt devices to copy configuration files and transfer them to actor-controlled or compromised infrastructure, often using TFTP.
- The actors also exploit Cisco vulnerabilities, Cisco Smart Install, and network-device management web portals.
- Communications, defense, energy, financial services, government, and healthcare are among the critical infrastructure sectors identified as at risk.
- Recommended measures include disabling SNMPv1/v2 and Cisco Smart Install, using SNMPv3 with authentication and encryption, restricting management access, monitoring sensitive OIDs, and updating device software.
Article Details
- Defense Focus
- Harden Internet-facing routers and other networking devices against Russian FSB Center 16 activity that abuses exposed SNMP and vulnerable device-management features.
- Detection Methods
- Inspect inbound SNMP Set-Requests for OIDs that trigger configuration copying or target sensitive device data.
- Monitor SNMP and device logs for configuration-copy activity, including requests involving the Cisco configuration-copy OIDs.
- Alert on unusual credentials and logins using local device accounts.
- Monitor network traffic for unexpected use of TFTP, Cisco Smart Install, and SNMP on externally exposed management interfaces.
- Data Sources
- Network-device and SNMP logs
- Intrusion detection system logs and alerts
- Network traffic and edge-firewall logs
- Network-device authentication and local-account login logs
- Rule Types
- IDS rules for inbound SNMP Set-Requests targeting sensitive OIDs
- SNMP OID and MIB allowlists
- Access Control Lists (ACLs) for management-protocol access
- Edge-firewall traffic filtering rules
- Platforms
- Routers and other network devices
- Intrusion detection systems
- Edge firewalls
- Defensive Actions
- Disable Cisco Smart Install on devices.
- Disable SNMPv1 and SNMPv2; use SNMPv3 with authPriv and the strongest supported encryption.
- If legacy SNMP versions are required, replace default community strings and use read-only access.
- Restrict management protocols to authorized management devices, preferably over an out-of-band network.
- Block external UDP 69, TCP 4786, UDP 161/162, and TCP/UDP 10161/10162 unless mission-critical; monitor strictly if blocking is not feasible.
- Patch network-device software and firmware, and replace end-of-life devices with supported ones.
- Use strong, unique device passwords, prefer Cisco password hashing type 8, and securely store credentials.
- Use centralized authentication and MFA where feasible; monitor local-account logins and unusual credentials.
MITRE ATT&CK
T1003 · OS Credential DumpingThe actors collect router configurations containing weak Cisco Type 7 passwords or Type 0 credentials.T1027 · Obfuscated Files or InformationThe actors use SNMP Set-Requests with spoofed source IP addresses.T1048 · Exfiltration Over Alternative ProtocolThe actors transfer collected configuration files over TFTP, which the advisory identifies as an alternative protocol for exfiltration.T1068 · Exploitation for Privilege EscalationThe advisory reports exploitation of known vulnerabilities for escalated privileges on Cisco devices.T1071 · Application Layer ProtocolThe advisory reports use of TFTP and FTP in the actors' network activity, including transferring collected configuration files.T1090 · ProxyThe actors run scans via proxies and use VPS or compromised servers as relays.T1190 · Exploit Public-Facing ApplicationThe actors exploit known Cisco vulnerabilities and network-device management portals.T1569 · System ServicesThe actors use SNMP Set-Requests to instruct poorly configured devices to perform actions such as copying configurations.T1583.003 · Virtual Private ServerThe actors use leased VPS infrastructure to receive configuration files transferred from compromised devices.T1584.008 · Network DevicesThe advisory says the actors compromise intermediate routers as part of their infrastructure.T1588.005 · ExploitsThe actors use publicly available exploit code against vulnerable networking devices.T1595.001 · Scanning IP BlocksThe actors scan Internet IP ranges for networking devices with active SNMP agents.T1595.002 · Vulnerability ScanningThe actors scan for poorly configured or vulnerable networking devices that accept common or default SNMP community strings.T1602.001 · SNMP (MIB Dump)The actors target MIB data to collect network information via SNMP.T1602.002 · Network Device Configuration DumpThe actors copy network-device configurations to files such as config.bkp or output.txt.
CVE
Threat Actors
Berserk BearListed as an industry tracking name related to the activity; the advisory cautions that industry naming does not necessarily map one-to-one to the authoring agencies' understanding.Crouching YetiListed as an industry tracking name related to the activity; the advisory cautions that industry naming does not necessarily map one-to-one to the authoring agencies' understanding.DragonflyListed as an industry tracking name related to the activity; the advisory cautions that industry naming does not necessarily map one-to-one to the authoring agencies' understanding.Energetic BearListed as an industry tracking name related to the activity; the advisory cautions that industry naming does not necessarily map one-to-one to the authoring agencies' understanding.Ghost BlizzardListed as an industry tracking name related to the activity; the advisory cautions that industry naming does not necessarily map one-to-one to the authoring agencies' understanding.Russian FSB Center 16The advisory attributes long-running activity to these Russian state-sponsored cyber actors, including scanning for exposed SNMP devices, collecting router configurations, and exploiting vulnerable networking devices.Salt TyphoonCited as another malicious cyber actor whose tactics and techniques overlap with those discussed; the advisory does not attribute the FSB Center 16 activity to Salt Typhoon.Static TundraListed as an industry tracking name related to the activity; the advisory cautions that industry naming does not necessarily map one-to-one to the authoring agencies' understanding.
Vendors
Products
Industries
communicationsRussian FSB Center 16 actors are exploiting poorly configured routers and other networking devices worldwide, with a focus on critical infrastructure sectors such as communications, energy, government, and healthcare.Defense industrial baseThe activity opportunistically targets critical infrastructure networks worldwide, including communications, defense industrial base, energy, financial services, government, and healthcare.EnergyRussian FSB Center 16 actors are exploiting poorly configured routers and other networking devices worldwide, with a focus on critical infrastructure sectors such as communications, energy, government, and healthcare.Financial ServicesThe activity opportunistically targets critical infrastructure networks worldwide, including communications, defense industrial base, energy, financial services, government, and healthcare.Government Services and FacilitiesGovernment Services and Facilities, especially organizations at the state and local level, and