FSB Centre 16 (Berserk Bear/Static Tundra) Targets Critical Infrastructure via Weak SNMP Credentials and Cisco Smart Install Exploitation (CVE-2018-0171) — UK/EU Attribute December 2025 Poland Energy Grid Attack

FSB Centre 16 (Berserk Bear/Static Tundra) Targets Critical (TL-2026-1283), also tracked as Berserk Bear Critical Infrastructure Campaign, is a high-severity nation state threat scored CVSS 9.8, first published 2026-07-13. It is attributed to FSB Centre 16 (Russia) with high confidence, affects Cisco IOS / IOS XE (Smart Install feature), references 1 CVE (CVE-2018-0171), maps to 27 MITRE ATT&CK techniques (T1018, T1021, T1046), and is covered by 9 detection rules and 18 indicators of compromise.

Key facts for TL-2026-1283

Threat ID
TL-2026-1283
Also known as
Berserk Bear Critical Infrastructure Campaign, Poland Energy Grid Attack December 2025
Severity
HIGH
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
NATION_STATE
First published
2026-07-13
Last reviewed
2026-07-13
Attribution
FSB Centre 16
Attribution confidence
HIGH
Nation-state nexus
Russia
Motivation
ESPIONAGE
Target sectors
energy, government administration, defence, communications, financial services, health, telecoms, higher education, manufacturing, critical infrastructure
Target regions
Europe, poland, ukraine, united kingdom, North America, Asia, Africa
Detection rules
9
Indicators of compromise
18

Malware and tooling in FSB Centre 16 (Berserk Bear/Static Tundra) Targets Critical

Malware and tooling: DynoWiper - S9038, SYNful Knock - S0519, Win32/KillFiles.NMO, Bespoke SNMP exploitation tooling, Cisco Smart Install (SMI) feature abuse

The UK NCSC and 18 partner agencies across 12 countries issued a joint advisory attributing sustained targeting of critical infrastructure network devices to Russia's FSB Centre 16 (Berserk Bear / Energetic Bear / Crouching Yeti / Dragonfly / Ghost Blizzard / Static Tundra), which scans the internet for routers with default or weak SNMP credentials and exploits the legacy Cisco Smart Install feature (CVE-2018-0171, CVSS 9.8) and web-portal flaws to gain persistent control of edge network devices. The UK and EU formally attributed a destructive 29 December 2025 attack on Poland's energy sector — which deployed the previously undocumented DynoWiper malware against OT/ICS equipment at renewable and combined-heat-and-power sites and risked cutting power to up to 500,000 civilians — to Russian military/intelligence cyber actors operating in this same ecosystem.

How FSB Centre 16 (Berserk Bear/Static Tundra) Targets Critical works

Centre 16 of Russia's Federal Security Service (FSB) — publicly tracked under the aliases Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard, and (per Cisco Talos) Static Tundra — is a long-running (10+ year) Russian state-sponsored cyber espionage operation specializing in the compromise of network infrastructure devices to gain durable footholds inside organizations of strategic interest to the Russian government. On 13 July 2026 the UK National Cyber Security Centre (NCSC), joined by 18 partner agencies across 12 countries (Australia, Canada, Czech Republic, Denmark, Estonia, Finland, France, Italy, New Zealand, Poland, Sweden, and the United States), published a joint advisory warning that the group is actively targeting the communications, defence, energy, financial services, government, and healthcare sectors.

The actor's primary access technique is internet-wide scanning for routers and switches still configured with default or weak SNMP (Simple Network Management Protocol) community strings and passwords, most commonly SNMPv1/v2 configurations lacking authentication or encryption. Where SNMP access alone is insufficient, the actor pivots to exploiting well-documented Cisco device vulnerabilities, most notably CVE-2018-0171, a CVSS 9.8 critical flaw in the Cisco IOS/IOS XE Smart Install (SMI) feature that allows an unauthenticated remote attacker to send crafted Smart Install messages to TCP port 4786 to trigger a device reload, cause an indefinite loop, or achieve arbitrary code execution due to inadequate packet validation (CWE-787 out-of-bounds write / CWE-20 improper input validation). Cisco patched CVE-2018-0171 in March 2018 and it has been on the CISA Known Exploited Vulnerabilities (KEV) catalog since November 2021, yet Static Tundra continues to find and compromise unpatched, end-of-life devices with Smart Install still enabled. The group additionally abuses unspecified Cisco web-management-portal vulnerabilities to gain device control.

Once a device is compromised, the actor's exploitation chain enables a TFTP server on the target and retrieves the running/startup configuration, harvesting SNMP community strings, local credentials, and network topology data. Persistence is established through compromised/newly-created privileged local accounts, additional read-write SNMP community strings, modification of TACACS+ configuration and ACLs to evade detection, and — per Talos's historical tracking — the SYNful Knock modular Cisco IOS firmware implant (first publicly documented in 2015), which survives reboots and grants remote access via a crafted 'magic packet' TCP SYN. The actor uses spoofed source IP addresses during SNMP command execution to complicate attribution and evade network monitoring, performs internal discovery via native device commands (e.g. 'show cdp neighbors') and by consuming Shodan/Censys scan data, establishes GRE tunnels and captures NetFlow data for traffic collection, and exfiltrates configuration data over TFTP, FTP, RCP, and the Cisco CISCO-CONFIG-COPY-MIB.

On 29 December 2025, a coordinated destructive cyber campaign hit at least thirty Polish wind and photovoltaic generation sites, a major combined heat and power (CHP) plant, and a manufacturing company. Per CERT Polska's incident report, the intrusion combined a long period of infiltration, theft of sensitive data, compromise of privileged Active Directory accounts, and unrestricted lateral movement, culminating in deployment of a previously undocumented wiper — DynoWiper (also identified as Win32/KillFiles.NMO) — intended to irreversibly destroy data on internal-network devices. Initial access to the OT/ICS environment was gained through vulnerable internet-facing edge devices. The attackers reached and damaged Hitachi RTU 560 remote terminal units, Mikronika controllers, ABB Relion 650 protection IEDs, Moxa NPort serial servers, and Windows-based HMIs and domain controllers. At the renewable-energy sites the attack did not halt electricity generation but severed communication with distribution system operators (DSOs) and removed remote supervisory control at the grid-connection layer, demonstrating that strategic OT impact can be achieved without an immediate blackout. At the CHP plant, deployed EDR tooling blocked activation of the wiper before it could execute its destructive payload. The UK and EU formally attributed the attack to Russian FSB-linked cyber actors, publicly noting that a fully successful attack could have caused up to 500,000 civilians to lose electricity; open-source technical reporting (CERT Polska, Dragos, The Hacker News) separately attributes the DynoWiper payload and OT-focused intrusion to Sandworm-associated (ELECTRUM) tradecraft, reflecting the well-documented overlap and shared infrastructure/tooling between Russian military (GRU-linked Sandworm) and FSB (Centre 16 / Static Tundra / Berserk Bear) offensive cyber units targeting the same strategic sectors.

MITRE ATT&CK techniques used in TL-2026-1283

Discovery

T1018 Remote System Discovery; T1046 Network Service Discovery

Lateral Movement

T1021 Remote Services

Exfiltration

T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

Execution

T1059 Command and Scripting Interpreter

Defense Evasion

T1070 Indicator Removal

Command and Control

T1071 Application Layer Protocol; T1090 Proxy

Initial Access

T1078.001 Default Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application

Privilege Escalation

T1078.001 Default Accounts

Persistence

T1098 Account Manipulation; T1136.001 Local Account

Credential Access

T1110 Brute Force; T1552 Unsecured Credentials

Impact

T1485 Data Destruction; T1489 Service Stop; T1561 Disk Wipe

Collection

T1560 Archive Collected Data; T1602 Data from Configuration Repository

Resource Development

T1583.003 Virtual Private Server; T1587.001 Malware

Reconnaissance

T1590 Gather Victim Network Information; T1595.001 Scanning IP Blocks

defense-impairment

T1599 Network Boundary Bridging; T1601.001 Patch System Image; T1685 Disable or Modify Tools

Affected products and versions in FSB Centre 16 (Berserk Bear/Static Tundra) Targets Critical

  • Cisco — IOS / IOS XE (Smart Install feature)
    Vulnerable versions: Devices with Smart Install enabled, unpatched pre-March 2018 IOS/IOS XE releases
    Fixed in: IOS/IOS XE releases per cisco-sa-20180328-smi2; or Smart Install disabled via 'no vstack'
  • Hitachi Energy — RTU 560 Remote Terminal Unit
    Vulnerable versions: Deployed units at targeted Polish renewable energy sites, December 2025 incident
  • ABB — Relion 650 Protection IED
    Vulnerable versions: Deployed units at targeted Polish energy sites, December 2025 incident
  • Mikronika — Industrial controllers
    Vulnerable versions: Deployed units at targeted Polish energy sites, December 2025 incident
  • Moxa — NPort serial server
    Vulnerable versions: Deployed units at targeted Polish energy sites, December 2025 incident

Remediation for FSB Centre 16 (Berserk Bear/Static Tundra) Targets Critical

Patches

  • Apply Cisco Security Advisory cisco-sa-20180328-smi2 (fixes CVE-2018-0171) to all affected Cisco IOS/IOS XE devices

Immediate actions

  • Disable Cisco Smart Install on all devices ('no vstack') or apply the CVE-2018-0171 patch immediately
  • Disable SNMPv1 and SNMPv2 on all network devices; migrate to SNMPv3 with authPriv (authentication + encryption)
  • Rotate all default and weak SNMP community strings and device passwords immediately
  • Block/restrict TCP port 4786 (Smart Install) at network boundaries and internally
  • Audit network devices for unauthorized privileged local accounts, unexpected SNMP RW community strings, and modified TACACS+/ACL configuration
  • Run Cisco's SYNful Knock detection scanner against Cisco IOS device fleets

Workarounds

  • If patching CVE-2018-0171 is not possible, disable the Smart Install feature entirely on the affected device

Longer-term hardening

  • Replace end-of-life network devices that cannot be patched or hardened
  • Implement centralized, out-of-band configuration management so devices are not treated as the trusted source of truth
  • Deploy multi-factor authentication and AAA controls for all device administration
  • Encrypt all monitoring/management traffic (SNMPv3, SSH, HTTPS, NETCONF, RESTCONF); disable Telnet and unencrypted web management interfaces
  • Segment OT/ICS networks from IT and internet-facing edge devices; monitor NetFlow for device behavior baseline deviation
  • Deploy EDR on OT-adjacent Windows systems (HMIs, domain controllers) as a backstop against wiper deployment
  • Obtain UK Cyber Essentials certification and align with the UK NCSC Cyber Assessment Framework (or equivalent national framework)

CVEs associated with FSB Centre 16 (Berserk Bear/Static Tundra) Targets Critical

CVE-2018-0171

Weaknesses (CWE) in FSB Centre 16 (Berserk Bear/Static Tundra) Targets Critical

CWE-787, CWE-20

Timeline of FSB Centre 16 (Berserk Bear/Static Tundra) Targets Critical

  • SYNful Knock, the modular Cisco IOS firmware implant later associated with this actor's persistence tradecraft, is first publicly documented by Mandiant/FireEye.
  • Cisco publishes advisory cisco-sa-20180328-smi2 and releases patches for CVE-2018-0171 (Cisco Smart Install remote code execution / device reload).
  • CISA adds CVE-2018-0171 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild.
  • Actor-controlled infrastructure IP 185.141.24[.]222 observed active per Cisco Talos tracking.
  • Actor-controlled infrastructure IPs 185.141.24[.]28 and 185.82.200[.]181 begin an observed activity window continuing into 2025.
  • Actor-controlled infrastructure IP 185.82.202[.]34 observed active through 28 February 2025.
  • Cisco Talos publishes 'Static Tundra' research and the FBI issues a warning on FSB-linked exploitation of unpatched Cisco devices via CVE-2018-0171.
  • Coordinated destructive cyberattack hits at least 30 Polish wind/photovoltaic sites, a combined heat and power plant, and a manufacturing company; DynoWiper malware deployed against OT/ICS devices, damaging Hitachi RTU 560 units and severing DSO communications; EDR blocks wiper execution at the CHP plant.
  • CERT Polska publishes a detailed incident report on the December 2025 energy-sector attack; open-source reporting (Dragos, The Hacker News) attributes the DynoWiper payload to Sandworm/ELECTRUM tradecraft.
  • CISA issues an alert highlighting OT/ICS security gaps exposed by the Poland energy-sector incident, for U.S. critical infrastructure operators.
  • UK NCSC, joined by 18 partner agencies across 12 countries, publishes a joint advisory; the UK and EU formally attribute the December 2025 Poland energy grid attack to Russia's FSB Centre 16, warning that up to 500,000 civilians could have lost power had the attack fully succeeded.

Sources cited for FSB Centre 16 (Berserk Bear/Static Tundra) Targets Critical

Threats related to FSB Centre 16 (Berserk Bear/Static Tundra) Targets Critical

Detection coverage for TL-2026-1283

As of 2026-07-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1283 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-1283

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats