The Federal Bureau of Investigation (FBI) warned the public, private sector, and international partners about the threat to computer networks and critical infrastructure from cyber actors linked to the Russian Federal Security Service’s Center 16. The FBI detected Russian FSB cyber actors exploiting Simple Network Management Protocol (SNMP) and end-of-life networking devices running an unpatched vulnerability (CVE-2018-0171) in Cisco Smart Install (SMI) to target entities, both globally and in the U.S.
“In the past year, the FBI detected the actors collecting configuration files for thousands of networking devices associated with US entities across critical infrastructure sectors,” the Wednesday IC3 alert disclosed. “On some vulnerable devices, the actors modified configuration files to enable unauthorized access to those devices. The actors used the unauthorized access to conduct reconnaissance in the victim networks, which revealed their interest in protocols and applications commonly associated with industrial control systems.”
The FSB Center 16 unit conducting this activity is known to cybersecurity professionals by several names, including ‘Berserk Bear’ and ‘Dragonfly,’ which refer to separate but related cyber activity clusters.
For over a decade, the unit has compromised networking devices globally, particularly devices accepting legacy unencrypted protocols like SMI and SNMP versions 1 and 2. This unit has also deployed custom tools to certain Cisco devices, such as the malware publicly identified as ‘SYNful Knock’ in 2015.
Providing more details of the FSB Center 16 threat, Cisco Talos researchers disclosed in a post that Static Tundra is a Russian state-sponsored cyber espionage group linked to the FSB’s Center 16 unit that has been operating for over a decade, specializing in compromising network devices for long-term intelligence gathering operations. Static Tundra has been observed as primarily targeting organizations in the telecommunications, higher education and manufacturing sectors, pivoting over time in alignment with shifts in Russian strategic interests. Known victims span multiple geographic regions, including North America, Asia, Africa and Europe.
“The group actively exploits a seven-year-old vulnerability (CVE-2018-0171), which was patched at the time of the vulnerability publications, in Cisco IOS software’s Smart Install feature, targeting unpatched and end-of-life network devices to steal configuration data and establish persistent access,” Sara McBroom and Brandon White, wrote in a Wednesday blog post.
They observed that Static Tundra is likely a sub-cluster of another group, ‘Energetic Bear’ (aka BERSERK BEAR), based on an overlap in tactics, techniques and procedures (TTPs) and victimology, which has been corroborated by the FBI. Energetic Bear was linked to the Russian Federal Security Service’s (FSB) Center 16 unit in a 2022 U.S. Department of Justice indictment. Talos also assesses with moderate confidence that Static Tundra is associated with the historic use of ‘SYNful Knock,’ a malicious implant installed on compromised Cisco devices publicly reported in 2015.
Static Tundra is assessed to be a highly sophisticated cyber threat actor that has operated for over a decade, conducting long-term espionage operations. Static Tundra specializes in network intrusions, demonstrated by the group’s advanced knowledge of network devices and use of bespoke tooling, possibly including the novel, but now decade-old, SYNful Knock router implant.
Static Tundra targets unpatched, and often end-of-life, network devices to establish access on primary targets and support secondary operations against related targets of interest. Once they establish initial access to a network device, Static Tundra will pivot further into the target environment, compromising additional network devices and establishing channels for long-term persistence and information gathering. This is demonstrated by the group’s ability to maintain access in target environments for multiple years without being detected.
For years, Static Tundra has been compromising Cisco devices by exploiting a previously disclosed vulnerability in the Smart Install feature of Cisco IOS software and Cisco IOS XE software (CVE-2018-0171) that has been left unpatched, often after those devices are end-of-life. We assess that the purpose of this campaign is to compromise and extract device configuration information en masse, which can later be leveraged as needed based on then-current strategic goals and interests of the Russian government. This is demonstrated by Static Tundra’s adaptation and shifts in operational focus as Russia’s priorities have changed over time.
Since Static Tundra was first observed in 2015, the group has targeted organizations in the telecommunications, higher education and manufacturing sectors. Victims are primarily based in Ukraine and allied countries, but also include other entities globally. Talos estimates Static Tundra will continue network intrusion campaigns into organizations that are of strategic interest to Russia, specifically manufacturing and higher education, and targets of political interest will likely continue to include Ukraine and its allies.
Talos assesses that the threat extends beyond Russia’s operations — other state-sponsored actors are likely conducting similar network device compromise campaigns, making comprehensive patching and security hardening critical for all organizations. “Threat actors will continue to abuse devices which remain unpatched and have Smart Install enabled.”
McBroom and White said that “one of the clearer targeting shifts we observed was that Static Tundra’s operations against entities in Ukraine escalated at the start of the Russia-Ukraine war, and have remained high since then. Static Tundra was observed compromising Ukrainian organizations in multiple verticals, as opposed to previously more limited, selective compromises typically being associated with this threat actor.”
They assess that Static Tundra’s two primary operational objectives are compromising network devices to gather sensitive device configuration information that can be leveraged to support future operations, and establishing persistent access to network environments to support long-term espionage in alignment with Russian strategic interests. Because of the large global presence of Cisco network infrastructure and the potential access it affords, the group focuses heavily on the exploitation of these devices and possibly also the development of tools to interact with and persist on these devices.
Moreover, Static Tundra utilizes bespoke tooling that prioritizes persistence and stealth to achieve these objectives. The tooling and techniques target old and unpatched edge devices.
Upon gaining initial access to a target environment, Static Tundra interacts with the SNMP service using community strings that were compromised during the initial access phase. In some cases, Static Tundra spoofs the source address of the SNMP traffic. This technique allows the threat actor to obfuscate their infrastructure and bypass access control lists (ACLs), as the SNMP protocol does not use session establishment. SNMP offers a variety of options for further execution on a compromised device, such as executing commands directly, modifying the running configuration and extracting the current running configuration or startup configuration.
Static Tundra leverages SNMP to send instructions to download a text file from a remote server and append it to the running configuration. This can allow for additional means of access via newly created local user accounts in conjunction with enabling remote services including TELNET.
“Due to the relatively static nature of network environments, Static Tundra often relies on compromised SNMP community strings and credentials to maintain access to systems over the course of multiple years,” McBroom and White detailed. “In some cases, Static Tundra creates privileged local user accounts and/or additional SNMP community read-write strings.”
They added that Static Tundra has been observed leveraging a Cisco IOS firmware implant known as SYNful Knock to achieve persistent access to compromised systems. “SYNful Knock is a modular implant that attackers inject into a Cisco IOS image and then load onto the compromised device. This provides a stealthy means of access that will persist through reboots. Remote access to the device can then be achieved by sending a specifically crafted TCP SYN packet, commonly referred to as a ‘magic packet.’”
Static Tundra has been observed modifying TACACS+ configuration on compromised devices, hindering remote logging capabilities. Static Tundra also modifies ACLs to permit access from specific IP addresses or ranges under their control. The group also likely uses publicly-available scan data from services such as Shodan or Censys to identify systems of interest. Once inside a target environment, Static Tundra relies heavily on native commands, such as ‘show cdp neighbors,’ to reveal additional systems of interest within the target environment. This presents a relatively stealthy way to identify further targets without the need for active scanning.
One of Static Tundra’s primary actions on objectives is to capture network traffic that would be of value from an intelligence perspective. To achieve this, Static Tundra establishes Generic Routing Encapsulation (GRE) tunnels that redirect traffic of interest to attacker-controlled infrastructure, which can then be captured and further analyzed. Static Tundra has also been observed collecting and exfiltrating NetFlow data on compromised systems, revealing source and destination information on streams of potential interest.
Talos reported that Static Tundra exfiltrates configuration information through a variety of means, including inbound TFTP connections via the Smart Install exploitation procedure mentioned in the Initial Access section, outbound TFTP or FTP connections from the compromised device to attacker-controlled infrastructure, and inbound SNMP connections using the copy configuration process.
Talos recommends that organizations take several steps to identify suspicious activity that may be linked to this campaign. They should begin with comprehensive configuration management, including auditing, in line with best practices. Authentication, authorization, and command issuance should also be closely monitored to detect anomalies. It is important to track syslog and AAA logs for unusual activity, such as a decrease in normal logging events or unexplained gaps in logged activity.
Organizations should monitor their environments for unusual changes in behavior or configuration. They should also profile network devices by fingerprinting through NetFlow and port scanning to detect shifts in the surface view, including new ports opening or closing and unexpected traffic to or from devices. Where possible, developing NetFlow visibility can help identify unusual volumetric changes.
They must further strengthen defenses by keeping systems fully updated, replacing end-of-life hardware and software, and applying configuration changes recommended in government and industry advisories. Strong access controls are essential, including the use of complex passwords, multi-factor authentication, and the elimination of default credentials.
All management and monitoring traffic should be encrypted, and credential systems such as TACACS+ should be tightly controlled and monitored. Administrative interfaces must be limited to what is strictly necessary, with non-encrypted options disabled. Access control lists should be reviewed regularly to ensure accuracy. Finally, organizations should centralize and manage device configurations, ensuring that individual devices are never treated as the sole source of truth.
