Russian Hackers Hitting Critical Infrastructure, FBI Warns

Russian intelligence hackers are using obsolete and unpatched equipment made by networking mainstay Cisco Systems to further stealthy and ongoing cyberespionage operations, the U.S. federal government warned Wednesday.

The FBI in an advisory report said hackers from the Federal Security Service – the FSB, the Russian successor to the KGB – are targeting the United States and allies IT and operational technology environments.

For at least the past year, the hackers have been “collecting configuration files for thousands of networking devices associated with U.S. entities across critical infrastructure sectors” and using the files to gain authorized access to the networking equipment, the bureau said. “The actors used the unauthorized access to conduct reconnaissance in the victim networks, which revealed their interest in protocols and applications commonly associated with industrial control systems.”

The U.S. government attributes the attacks to an FSB unit known as Center 16. The group exploits a vulnerability in the Smart Install feature of Cisco devices, tracked as CVE-2018-0171, which attackers can use to execute arbitrary code on a device.

Cisco Talos, the networking giant’s threat intel arm, said the threat cluster behind the attacks, which it tracks as “Static Tundra,” regularly “targets unpatched, and often end-of-life, network devices to establish access on primary targets and support secondary operations against related targets of interest.”

Researchers said the group most frequently targets the telecommunications, higher education and manufacturing sectors in Ukraine and allied countries, but also other organizations globally, including those that hold a political or strategic interest for Russia.

Since 2021, the hackers have been “aggressively exploiting” the long-patched CVE-2018-0171 vulnerability to enable the local Trivial File Transfer Protocol, or TFTP, server on a device, after which they attempt to retrieve the device’s startup configuration and obtain access credentials or use simple network management protocol access strings to gives themselves more direct access, Cisco Talos said.

Researchers said Static Tundra appears to be part of a bigger FSB unit tracked as Energetic Bear, aka Berserk Bear and Dragonfly, which the U.S. government in a 2022 indictment first publicly tied to FSB’s Center 16 (see: Feds Charge 4 Russians With Long-Term Energy Sector Attacks).

“For over a decade, this unit has compromised networking devices globally, particularly devices accepting legacy unencrypted protocols like SMI and SNMP versions 1 and 2,” the FBI said. “This unit has also deployed custom tools to certain Cisco devices, such as the malware publicly identified as ‘SYNful Knock’ in 2015.”

The SYNful Knock “router implant” is designed to inject a Cisco IOS image and load it on a router, giving attackers access to the device, a moniker U.S. cybersecurity firm FireEye bestowed on the malware a decade ago.

Attackers’ goal is simple: to penetrate a victim’s environment, in as stealthy a manner as possible.

“Once they establish initial access to a network device, Static Tundra will pivot further into the target environment, compromising additional network devices and establishing channels for long-term persistence and information gathering,” Cisco Talos said. “This is demonstrated by the group’s ability to maintain access in target environments for multiple years without being detected.”

For safeguarding the equipment being targeted, Cisco Talos recommends either immediately patching CVE-2018-0171 or else disabling Smart Install. That feature has been the subject of repeated warnings over the past half-decade. Cisco in early 2017 warned that hackers use the “plug and play” configuration and “image-management feature” to hack routers. Guidance from the NSA published the same year advised users to disable Smart Install. Not every system administrator has done so, since Chinese nation-state hackers tracked as Salt Typhoon also used the vulnerability to hack into U.S. telecom systems (see: Talos: No Cisco Zero Days Used in Salt Typhoon Telecom Hacks).

The FBI pointed to Cybersecurity and Infrastructure Security alert from 2018 warning that about Russian state-sponsored cyber actors targeting network infrastructure devices, stating that its guidance is still valid. It also referenced CISA guidance from May about locking down OT environments.