Cisco Warns State-Sponsored Actors Are Targeting Network Infrastructure
Summary
Cisco Talos reports state-sponsored actors targeting routers and firewalls for espionage and potential destructive operations, and urges organizations to strengthen credentials, update equipment, encrypt management traffic, and monitor for suspicious changes.
Key points
- Talos says it has observed traffic manipulation, hidden configurations, router malware, reconnaissance, and weakened defenses on network devices.
- Observed activity includes hijacked DNS traffic, GRE tunnels, captured network traffic, malicious software, and device configurations altered to enable further access.
- The article cites the Jaguar Tooth campaign, which targeted weak SNMP community strings and exploited CVE-2017-6742, for which a patch was available in 2017.
- Talos says attackers also target credential systems, management servers, and jump hosts; some exploits occur after attackers gain credentials or internal access.
- Recommendations include complex credentials, multifactor authentication, encrypted management protocols, current hardware and software, and retiring end-of-life equipment.
- Organizations are urged to monitor configuration changes, AAA and syslog events, unexpected tunnels, and connections to edge routers from unknown external IPs.
Article Details
- Defense Focus
- Detect and prevent compromise of network infrastructure through secure configuration, timely patching, credential protection, and monitoring for suspicious changes and activity.
- Detection Methods
- Use NetFlow analysis to identify unauthorized GRE tunnels or static VPNs.
- Monitor connections to edge routers from unknown external IP addresses.
- Monitor configuration changes and alert on departures from documented baselines.
- Review AAA logs for unusual router actions, including attempts to suppress accounting with “no aaa accounting”; configure AAA to deny attempts to disable protections.
- Monitor syslog and AAA logs for unusual activity.
- Aggressively monitor TACACS+ systems and jump hosts.
- Data Sources
- NetFlow
- Router configurations and configuration-change records
- AAA logs
- Syslog
- External connection records for edge routers
- TACACS+ and jump-host activity
- Defensive Actions
- Use complex passwords and SNMP community strings; avoid default credentials.
- Enable multifactor authentication where possible.
- Encrypt monitoring and configuration traffic; use SNMPv3, HTTPS, SSH, NETCONF, or RESTCONF.
- Lock down credential systems and jump hosts, and monitor them closely.
- Replace end-of-life hardware and software, and maintain current software.
- Use AAA policy to deny configuration changes that disable key protections.
- Document expected network configurations and investigate unauthorized tunnels, VPNs, external router connections, and other unusual behavior or configuration changes.
- Contact Cisco TAC for assistance with a suspected compromised Cisco product, or Cisco PSIRT to report or obtain support for a suspected vulnerability.
MITRE ATT&CK
T1090 · ProxyThe article describes creating GRE tunnels and hub-and-spoke VPNs to route traffic through actor-controlled infrastructure.T1114 · Email CollectionThe article reports copying and capturing network traffic for later retrieval, sometimes limited to specific IPs or protocols.T1190 · Exploit Public-Facing ApplicationIn the Jaguar Tooth campaign, attackers exploit CVE-2017-6742 on routers after finding SNMP community strings.T1556 · Modify Authentication ProcessThe article describes targeting TACACS+/RADIUS servers to obtain credentials and learn the controls enforced by those systems.T1557 · Adversary-in-the-MiddleThe article reports traffic manipulation and DNS traffic hijacking on compromised network devices.T1590 · Gather Victim Network InformationThe article describes infrastructure reconnaissance, including searching enterprise networks for network data and credentials.
CVE
People
Malware
Vendors
Products
Cisco network infrastructureBecause of the large presence of Cisco network infrastructure around the world, any sustained attack against network infrastructure would likely target Cisco equipment, but attacks are by no means limited to CiscoNETCONFusing SNMP v3, even well-chosen credentials are transmitted in the clear, and are subject to capture. NETCONF (Network Configuration Protocol) and RESTCONF are modern network management protocols designed to offerRADIUSobserved well-positioned adversaries with preexisting access to internal environments targeting TACACS+/RADIUS servers to obtain credentials. This gives them the benefit of understanding the controls enforced by theRESTCONFare transmitted in the clear, and are subject to capture. NETCONF (Network Configuration Protocol) and RESTCONF are modern network management protocols designed to offer better security and functionality than theirSecure Boottechnologies include hardware improvements such as the Trust Anchor Module and software changes like Secure Boot. Organizations that fail to update their hardware and software will both be more likely to be a victimSecureXSecureXSNMPThe Jaguar Tooth attacks are actually a sequence of attacks, the first looks for poorly selected SNMP community strings. Once a community string is found, the attacker exploits CVE-2017-6742, which was first announcedTACACS+enterprise attacks explicitly targeting the environments that support infrastructure devices such as TACACS+ servers, enterprise management servers and jump hosts. Further, we have seen espionage activity onTrust Anchor Moduleintroduced a series of technologies. These technologies include hardware improvements such as the Trust Anchor Module and software changes like Secure Boot. Organizations that fail to update their hardware and