US and Allies Warn of Russian APT Groups Targeting Network Devices

The US and allied governments have raised alarms regarding Russian state-sponsored APT groups that are actively scanning and exploiting poorly secured network devices, particularly routers. These groups, linked to the FSB Center 16, include Berserk Bear, Energetic Bear, Ghost Blizzard, Crouching Yeti, Dragonfly, and Static Tundra. Their targets span critical sectors such as communications, defense, energy, finance, government, and healthcare.

According to a joint advisory, Russian FSB Center 16 cyber actors are taking advantage of poorly configured and vulnerable networking devices worldwide, compromising multiple critical infrastructure sector networks. The advisory states that these actors primarily focus on poorly configured routers by scanning the internet for exposed Simple Network Management Protocol (SNMP) services that utilize weak or default credentials.

The attackers employ spoofed requests to extract device configurations, which are then transferred to servers controlled by the attackers through TFTP or FTP. Additionally, they exploit known vulnerabilities in Cisco devices and management interfaces. While these tactics are not exclusive to Russian actors, the recommended security measures are applicable against various threats.

The advisory emphasizes that the primary method for discovering and exploiting vulnerable devices is through SNMP scanning. The actors scan IP ranges for active SNMP agents that accept common or default community strings for authentication. In addition to SNMP scanning, they may exploit common vulnerabilities and exposures (CVEs) in Cisco devices, including CVE-2018-0171 and CVE-2008-4128, as well as Cisco’s Smart Install (SMI) functionality and web management portals.

To bolster security, network defenders are advised to disable Cisco Smart Install, upgrade from SNMPv1/v2 to SNMPv3 with strong encryption, and enforce the use of unique passwords with secure storage. Organizations should also monitor SNMP activity, restrict management access through access control lists (ACLs), block unnecessary ports such as TFTP, SMI, and SNMP from external networks, and detect any suspicious configuration changes. Keeping firmware updated, replacing unsupported devices, and utilizing attack surface management tools to identify exposed systems and weak configurations are also recommended steps to enhance network security.