Hackers linked to the Russian government have been exploiting a vulnerability in Cisco networking devices to target critical infrastructure organizations, the FBI said on Wednesday.
“In the past year, the FBI detected the actors collecting configuration files for thousands of networking devices associated with US entities across critical infrastructure sectors,” the bureau said in an alert.
The Cybersecurity and Infrastructure Security Agency lists energy among 16 critical infrastructure sectors.
The hackers, whom the FBI linked to the Russian Federal Security Service’s Center 16, have been taking advantage of a bug in Cisco’s IOS software, tracked as CVE-2018-0171, to execute arbitrary code on unpatched and end-of-life network switches made by Cisco and Rockwell Automation.
In some cases, the attackers modified configuration files to gain access to the devices and conduct reconnaissance focused on “protocols and applications commonly associated with industrial control systems,” according to the FBI.
FSB, aka Berserk Bear, Dragonfly
The FSB’s Center 16, which has conducted operations that researchers track using the names “Berserk Bear” and “Dragonfly,” has spent more than a decade penetrating computer systems by exploiting networking devices’ use of unencrypted protocols, the FBI said.
Cisco researchers on Wednesday published their own account of the Russia-linked group, which they call Static Tundra. The group focuses on telecommunications, education and manufacturing organizations around the world, Cisco said, “with victims selected based on their strategic interest to the Russian government,” mostly in Ukraine and its allies.
Both the FBI and Cisco linked the FSB’s Center 16 to the SYNful Knock malware, which Google detected in four countries, including Ukraine, in 2015.
Cisco said the group’s operations against Ukrainian targets have increased significantly since Moscow expanded its invasion of Ukraine in 2022. “Static Tundra was observed compromising Ukrainian organizations in multiple verticals,” Cisco said, “as opposed to previously more limited, selective compromises typically being associated with this threat actor.”
