Russian State Hackers Capitalize on Seven-Year-Old Cisco Router Flaw

The FBI and Cisco have issued urgent warnings about Russian hackers exploiting a seven-year-old vulnerability in Cisco Smart Install, impacting outdated routers and switches globally.

A significant number of legacy Cisco devices, which no longer receive security updates, are currently being targeted as part of a sophisticated cyber espionage campaign, as reported by the FBI and Cisco Talos.

The Russian state-sponsored threat group, known variously as Static Tundra, Dragonfly, Energetic Bear, and Berserk Bear, is leveraging the unpatched vulnerability, CVE-2018-0171. This flaw, related to Cisco’s Smart Install feature, enables attackers to execute arbitrary code or reboot devices. Although Cisco issued a patch in 2018, many systems remain vulnerable due to lack of updates or because they have reached end-of-life status and are no longer supported. These devices are prevalent in sectors like telecommunications, manufacturing, and academia, making them attractive targets for Russian intelligence operations.

Back in April 2018, incidents were reported where attackers exploited CVE-2018-0171 to compromise Cisco switches in data centers in Iran and Russia, hijacking devices and altering their IOS images to display an ASCII representation of the U.S. flag alongside a political message.

Image from April 2018 demonstrating a compromised Cisco switch showing the U.S. flag with the message “Don’t mess with our elections.” (Credit: Hackread.com)

Static Tundra is associated with the Federal Security Service (FSB) of Russia and has been operational for over ten years. Researchers reveal that the group has established automation tools to scan the internet, utilizing services like Shodan and Censys to locate targets still utilizing the Smart Install feature.

When they successfully breach a device, they extract configuration data, which often includes administrative credentials and network infrastructure details, giving them a platform for more extensive intrusions. Reports indicate that the FBI has detected the exfiltration of configuration data from thousands of U.S. devices across critical infrastructure sectors. In some instances, these adversaries modified device settings to maintain access, particularly focusing on systems crucial for industrial operations.

Static Tundra has a track record of deploying SYNful Knock, a malicious implant for Cisco routers documented since 2015. This exploit remains active even after reboots, allowing continued remote access through specially crafted packets. The group also exploits insecure SNMP community strings, including default ones like “public,” to gather additional information or issue commands on targeted devices.

Cisco Talos researchers characterize the group’s operations as “highly sophisticated,” noting that compromised devices can languish under attacker control for years. They caution that Russia is not the only nation conducting such operations, suggesting that any organization employing outdated or unpatched networking equipment is potentially at risk from various state-sponsored adversaries.

Expert Comment

In response to the FBI’s alert, security experts emphasize the critical importance of maintaining an up-to-date inventory of assets to understand vulnerabilities and ensure ongoing patch management. Trey Ford, Chief Strategy and Trust Officer at Bugcrowd, remarked that while certain sectors may experience production delays in patching cycles, the widespread exploitation of a vulnerability that is seven years old is concerning.

PATCH, PATCH, PATCH

Both the FBI and Cisco strongly recommend that organizations immediately patch devices running Smart Install or disable the feature if patching is not feasible. As for unsupported hardware, Cisco advocates for planning replacements given that these devices will not receive any further security updates. Cybersecurity professionals are advised to watch for unusual configuration changes, strange SNMP traffic, and unexplained TFTP activity, which are common indicators of this active campaign.

The FBI encourages anyone who suspects their systems may have been compromised to report their findings through the Internet Crime Complaint Center, underscoring the need for vigilance in cybersecurity.

Source

Related Posts

BlackByte 2.0 Ransomware: Rapid Infiltration, Data Encryption, and Extortion in Just 5 Days

Published: Jul 07, 2023
Category: Endpoint Security / Ransomware

Ransomware attacks pose a severe challenge for organizations globally, and the threat level continues to escalate. Recently, Microsoft’s Incident Response team delved into the BlackByte 2.0 ransomware attacks, revealing the alarming speed and destructive impact of these cyber assaults. Their findings underscore that cybercriminals can execute a complete attack—from initial infiltration to inflicting considerable damage—in just five days. Hackers swiftly breach systems, encrypt critical data, and demand ransom for its release. This drastically reduced timeline presents significant hurdles for organizations striving to bolster their defenses against such threats. BlackByte ransomware operates in the final phase of the attack, employing an 8-digit key to encrypt files. The investigation highlighted that attackers leverage a potent mix of tactics, particularly exploiting unpatched Microsoft Exchange Servers.

Revolut Suffers $20 Million Loss After Security Flaw in Payment System is Exploited

Malicious actors took advantage of an undisclosed vulnerability in Revolut’s payment systems, leading to the theft of over $20 million in early 2022, as reported by the Financial Times. The breach, which has not been made public, originated from inconsistencies between Revolut’s U.S. and European operations, resulting in erroneous refunds using the company’s funds when certain transactions were declined. The issue was first identified in late 2021, but before it could be resolved, organized crime groups exploited the loophole by prompting individuals to initiate costly purchases that would be declined. These refunded amounts were subsequently withdrawn from ATMs. While the exact technical details of the vulnerability remain unclear, approximately $23 million was stolen in total, with some of the funds retrieved by tracking those who had withdrawn cash.

Caution: Big Head Ransomware on the Rise—Disguised as Phony Windows Updates

July 11, 2023
Ransomware / Windows Security

A newly emerging ransomware known as Big Head is spreading via a malvertising campaign that masquerades as fake Microsoft Windows updates and Word installers. Initially identified by Fortinet FortiGuard Labs last month, multiple variants of this ransomware have been found, all designed to encrypt files on victims’ devices in exchange for cryptocurrency payments. According to Fortinet researchers, “One variant of the Big Head ransomware presents a fake Windows Update, suggesting it may also be distributed as counterfeit updates.” Another variant features a Microsoft Word icon, indicating its distribution as fraudulent software. The majority of Big Head samples reported so far are from the U.S., Spain, France, and Turkey. Recent analysis by Trend Micro has further explored this .NET-based ransomware, highlighting its capability to deploy three encrypted binaries: 1.exe for propagation…