FBI Warns FSB-Linked Hackers Exploiting Unpatched Cisco Devices for Cyber Espionage
Summary: Cisco Talos reported that Static Tundra, a Russian state-sponsored group assessed to be linked to the FSB's Center 16 unit, is actively exploiting CVE-2018-0171, a seven-year-old critical flaw (CVSS 9.8) in the Smart Install feature of Cisco IOS and IOS XE software, targeting telecommunications, higher education and manufacturing organizations across North America, Asia, Africa and Europe. The FBI said in a concurrent advisory that FSB actors have collected configuration files for thousands of networking devices at U.S. entities across critical infrastructure sectors, modifying configurations for unauthorized access, deploying the SYNful Knock router implant, using SNMP to pull a text file into the running configuration, and redirecting traffic through GRE tunnels with exfiltration over TFTP or FTP.
Key Takeaway: The flaw is seven years old and the devices are often end-of-life, yet FSB-linked actors used it to pull configuration files from thousands of U.S. critical infrastructure devices and to alter TACACS+ settings so remote logging would not show the work.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2018-0171
- Related
- Weathering the storm: In the midst of a Typhoon Cyber Risks ·