Russian Cyber Threat Actors Target Routers with Weak Credentials
Nineteen national cybersecurity agencies have raised alarms about Russian state-sponsored threat actors systematically scanning the internet for routers that operate with default or weak credentials. This campaign is linked to the FSB Centre 16, a unit within Russia's Federal Security Service. The focus is on routers running versions 1 and 2 of the Simple Network Management Protocol (SNMP), which utilize default or commonly used community strings. These community strings act as shared passwords, allowing devices that recognize them to query and potentially alter router settings.
With SNMP v1 and v2, these community strings are transmitted unencrypted, making them vulnerable to interception. When attackers identify a device that accepts a guessable community string, they can command it to copy its configuration file and transfer it using TFTP, an outdated and unauthenticated file transfer protocol. Such configuration files often contain additional credentials, providing attackers with an easy entry point without needing to exploit other vulnerabilities.
The advisory notes that FSB Centre 16 rarely resorts to exploiting known vulnerabilities, focusing instead on these easily accessible targets. Among the vulnerabilities mentioned is CVE-2008-4128, which dates back 18 years and pertains to multiple cross-site request forgery flaws in devices that have reached end-of-life status. Despite its age, this vulnerability was only recently added to the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalog. Another vulnerability, CVE-2018-0171, affects Cisco's Smart Install feature, allowing unauthenticated remote attackers to trigger device reloads, potentially leading to denial of service conditions or arbitrary code execution.
To counter these threats, cybersecurity agencies recommend that organizations upgrade to SNMP v3, which incorporates authentication and encryption, and disable SNMP v1 and v2 wherever possible. Changing factory default community strings is also essential. Furthermore, even SNMP v3 should not be exposed on internet-facing interfaces; management access should be limited to an out-of-band network secured by access control lists. Other suggested measures include disabling Cisco's Smart Install feature after initial configuration, securely storing credentials using Cisco's Type 8 password hashing where applicable, and blocking TFTP, SNMP, and Smart Install traffic at the network perimeter.
FSB Centre 16 has been actively scanning for vulnerable routers for over a decade. Security vendors have tracked this actor under various aliases, including Berserk Bear, Energetic Bear, Dragonfly, and Static Tundra. The sectors most at risk include communications, energy, financial services, healthcare, and government services, with state and local governments particularly vulnerable within the latter category.
