# FSB Center 16 (Static Tundra / Berserk Bear) Exploits Default/Weak SNMP and Unpatched Cisco Smart Install (CVE-2018-0171) to Compromise Networking Devices — AA26-194A

> CISA, FBI, NSA, and an international coalition (CSE, ASD, NCSC-NZ, NCSC-UK, NUKIB, and agencies from the Czech Republic, Denmark, Estonia, Finland, France, Italy, Poland, and Sweden) issued joint advisory AA26-194A warning that Russian FSB Center 16 cyber actors — tracked as Static Tundra, Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, and Ghost Blizzard — are opportunistically scanning for and compromising poorly configured and end-of-life networking devices worldwide via default/weak SNMP community strings and unpatched Cisco Smart Install (CVE-2018-0171).

- **Published:** 2026-07-13T00:00:00Z
- **Last reviewed:** 2026-07-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1276
- **ID:** TL-2026-1276
- **Severity:** HIGH (CVSS 9.8)
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** FSB Center 16 (Russia)
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2018-0171

## Description

On 2026-07-13, CISA and a broad international coalition of cybersecurity and intelligence agencies published AA26-194A, "Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting," documenting sustained, multi-year exploitation of Cisco networking devices by Russian Federal Security Service (FSB) Center 16 cyber actors. The activity cluster, publicly tracked by Cisco Talos as Static Tundra and assessed as a likely sub-cluster of the long-running Energetic Bear / Berserk Bear (aka Crouching Yeti, Dragonfly, Ghost Blizzard) operation, has been linked to FSB Center 16 by a 2022 US Department of Justice indictment.

The actors conduct broad, opportunistic internet scanning (leveraging services such as Shodan and Censys) to identify Cisco IOS and IOS XE devices running the legacy Smart Install (SMI) feature, which listens unauthenticated on TCP port 4786. Where Smart Install remains enabled, the actors exploit CVE-2018-0171 — a buffer overflow in SMI packet parsing (CWE-787/CWE-20) that Cisco patched in March 2018 but that persists on unpatched and end-of-life devices — to trigger device reloads or achieve arbitrary code execution. Post-exploitation, actors issue commands such as `tftp-server nvram:startup-config` to spawn a TFTP listener on the victim device and retrieve the running/startup configuration, harvesting locally stored credentials and SNMP community strings.

In parallel, actors conduct mass scanning for devices accepting default or weak SNMP community strings (commonly "public"/"private" with read-write access) using SNMPv1/v2c, then abuse the CISCO-CONFIG-COPY-MIB to remotely copy device configurations out via TFTP/FTP/RCP, in some cases spoofing source IP addresses to bypass ACL restrictions. Recovered configurations are mined for additional credentials, VPN/TACACS+ secrets, and network topology, enabling lateral movement to further devices.

On devices where deeper persistence is desired, the actors have been associated with the SYNful Knock firmware implant (first publicly documented in 2015) — a modular, reboot-persistent modification of the Cisco IOS image activated by a crafted "magic packet" TCP SYN sequence. Actors additionally create unauthorized privileged local user accounts, enable insecure legacy management services (e.g., re-enabling Telnet), modify ACLs to permit persistent inbound access, and in some environments establish GRE tunnels and collect NetFlow data to intercept and analyze victim network traffic for follow-on espionage collection.

Victimology spans Defense Industrial Base, communications, energy, financial services, government facilities, healthcare, telecommunications, manufacturing, and higher-education networks across North America, Europe, Asia, and Africa, with escalated and sustained targeting of Ukrainian organizations since Russia's February 2022 full-scale invasion. The group has also been associated with disruptive activity against European energy infrastructure, including reported involvement in an attack affecting Poland's energy grid in December 2025. Many of the exploited weaknesses (default/weak SNMP strings, enabled Smart Install, unencrypted legacy management protocols) are configuration issues rather than unpatched software, meaning organizations can substantially reduce exposure through router/switch hygiene alone, independent of vendor patch cycles.

## MITRE ATT&CK

- T1590 Gather Victim Network Information
- T1595 Active Scanning
- T1583 Acquire Infrastructure
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1136 Create Account
- T1556 Modify Authentication Process
- T1505 Server Software Component
- T1601 Modify System Image
- T1685 Disable or Modify Tools
- T1599 Network Boundary Bridging
- T1552 Unsecured Credentials
- T1110 Brute Force
- T1046 Network Service Discovery
- T1016 System Network Configuration Discovery
- T1040 Network Sniffing
- T1602 Data from Configuration Repository
- T1105 Ingress Tool Transfer
- T1095 Non-Application Layer Protocol
- T1048 Exfiltration Over Alternative Protocol
- T1498 Network Denial of Service

## Sources

- [Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting (AA26-194A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-194a)
- [Russian Government Cyber Actors Targeting Networking Devices, Critical Infrastructure (FBI Alert)](https://www.fbi.gov/investigate/cyber/alerts/2025/russian-government-cyber-actors-targeting-networking-devices-critical-infrastructure)
- [Russian Government Cyber Actors Targeting Networking Devices, Critical Infrastructure (IC3 PSA 250820)](https://www.ic3.gov/PSA/2025/PSA250820)
- [Russian state-sponsored espionage group Static Tundra compromises unpatched end-of-life network devices](https://blog.talosintelligence.com/static-tundra/)
- [NCSC issues warning over Russian intelligence-backed threat group](https://www.itpro.com/security/ncsc-issues-warning-over-russian-intelligence-backed-threat-group)
- [Russian hackers exploit old Cisco flaw to target global enterprise networks](https://www.csoonline.com/article/4043721/russian-hackers-exploit-old-cisco-flaw-to-target-global-enterprise-networks.html)
- [Russian FSB Center 16 exploits decade-old Cisco flaw in cyber espionage campaign to target critical infrastructure](https://industrialcyber.co/threats-attacks/russian-fsb-center-16-exploits-decade-old-cisco-flaw-in-cyber-espionage-campaign-to-target-critical-infrastructure/)
- [Russian Espionage Group Static Tundra Targets Legacy Cisco Flaw](https://www.infosecurity-magazine.com/news/russian-espionage-group-targets/)
- [US and allies share defense tips against Russian hackers targeting critical infrastructure](https://www.bleepingcomputer.com/news/security/us-and-allies-share-defense-tips-against-russian-hackers-targeting-critical-infrastructure/)
- [NSA and Partners Release Guidance on Improving Router Hygiene to Protect Against Russian State-Sponsored Targeting](https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4541059/nsa-and-partners-release-guidance-on-improving-router-hygiene-to-protect-agains/)
- [CVE-2018-0171 Detail](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2018-0171)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1276