Cherry pie, Douglas firs and the last trip of the summer
Summary: Cisco Talos reports that Static Tundra, a Russian state-backed group, is exploiting end-of-life and unpatched Cisco network devices through CVE-2018-0171, a vulnerability patched seven years ago, to steal data and hold long-term hidden access. The group uses persistent implants and bespoke SNMP tools to exfiltrate data and stay undetected, targeting entities of strategic interest to the Russian government.
What's compelling: A seven-year-old patch is still the way in for a state-backed actor, so any unpatched or end-of-life Cisco device on your network is a standing invitation to undetected access and data theft.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Mentions
- CVE-2018-0171
- Related
- CVE-2018-0171: Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021