Russian state-sponsored espionage group Static Tundra compromises unpatched end-of-life network devices
Summary: Cisco Talos has designated "Static Tundra" a Russian state-sponsored espionage group, assessed with high confidence as likely a sub-cluster of Energetic Bear, which a 2022 U.S. Department of Justice indictment linked to the FSB's Center 16 unit. Since 2015 the group has compromised unpatched and often end-of-life Cisco devices, aggressively exploiting CVE-2018-0171 in Smart Install since at least 2021 and maintaining access in target environments for multiple years without detection.
Why it matters: Cisco patched CVE-2018-0171 in 2018, yet Static Tundra has exploited it since at least 2021 to extract device configurations en masse and hold access for years - and the group has used SNMP community strings of "anonymous" and "public" with read-write permissions to get in.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2018-0171
- Related
- Weathering the storm: In the midst of a Typhoon Cyber Risks ·