A Cisco bug is being exploited by a Russian espionage group, researchers have revealed.

The exploit concerns Cisco’s Simple Network Management Protocol (SNMP) on retired networking devices running an unpatched exploit.

Attacks have been linked to the Russian Federal Security Service's (FSB) Center 16, which since 2015 has hit organizations in the telecommunications, higher education, and manufacturing sectors, primarily in Ukraine and allied countries. Aliases for the Russian state-sponsored unit include Berserk/Energetic Bear, Dragonfly, and the more commonly used Static Tundra.

According to research from Cisco Talos, the unit has targeted Cisco devices since 2021 by exploiting a seven-year-old vulnerability in the Smart Install feature of Cisco IOS software and Cisco IOS XE software. Tracked as CVE-2018-0171, the bug has been left unpatched by Cisco for said devices due to their retired status.

The remote code execution (RCE) vulnerability allows attackers to either force the affected device to restart, causing a denial-of-service (DoS) condition, or to execute arbitrary code on it.

A patch was issued by Cisco for the flaw in 2018. Customers unable to download the patch due to their device status are advised to disable the Smart Install feature, which was deprecated due to significant security vulnerabilities.

In addition to applying the update, Cisco Talos urged the following recommendations to customers:

• Leverage Cisco Hardening Guides when configuring devices.
• Disable Telnet and ensure it is not available on any of the virtual teletype (VTY) lines on Cisco devices by configuring all VTY stanzas with “transport input ssh” and “transport output none."
• Disable Cisco’s Smart Install service using “no vstack” for any device where application of the available patch is not possible, and develop end-of-life management plans for technology too old to patch.
• Utilize Type 8 passwords for local account credential configuration.
• Utilize Type 6 for terminal access controller access-control system plus (TACACS+) key configuration.

In a separate briefing, the FBI advised anyone who suspects they are a victim of the attack to contact them online or in-person at a field office.

How the attack works

Talos asserts that Static Tundra employs custom automation to exploit the Cisco Smart Install vulnerability against IP addresses it likely discovers through Shodan or Censys scanning tools.

After gaining entry, the actor enables the Trivial File Transfer Protocol (TFTP) service and retrieves the startup configuration, exposing passwords and SNMP community strings.

Spoofed SNMP commands then adjust the running configuration, append files that create new local accounts, and turn on Telnet for remote management. Persistent access is maintained with reused SNMP credentials or, when required, the SYNful Knock malware, which survives reboots.

To stay hidden, the group disables TACACS+ logging and modifies access control lists (ACLs) to allow its own infrastructure. Reconnaissance begins with publicly available scan data and shifts to stealthy, on-device commands.

For collection, Static Tundra relies on generic routing encapsulation (GRE) tunnels to mirror selected traffic and on NetFlow telemetry for off-device analysis, while configuration files are exfiltrated via TFTP, the file transfer protocol (FTP), or SNMP copy operations that use the CONFIG-COPY management information base (MIB).

“We assess that Static Tundra’s two primary operational objectives are 1) compromising network devices to gather sensitive device configuration information that can be leveraged to support future operations, and 2) establishing persistent access to network environments to support long-term espionage in alignment with Russian strategic interests,” Cisco's Talos group noted.

Talos also warned that other state-sponsored groups are likely running comparable campaigns against network hardware.

A more recent RCE vulnerability affecting Cisco users was revealed this week, which affects Cisco’s Secure Firewall Management Center (FMC).

RCE issues have also affected Microsoft systems recently, with one exploit this week taking down telecom vendor Colt platforms, an issue which remains ongoing at time of writing.