# FSB Centre 16 (Berserk Bear/Static Tundra) Targets Critical Infrastructure via Weak SNMP Credentials and Cisco Smart Install Exploitation (CVE-2018-0171) — UK/EU Attribute December 2025 Poland Energy Grid Attack

> The UK NCSC and 18 partner agencies across 12 countries issued a joint advisory attributing sustained targeting of critical infrastructure network devices to Russia's FSB Centre 16 (Berserk Bear / Energetic Bear / Crouching Yeti / Dragonfly / Ghost Blizzard / Static Tundra), which scans the internet for routers with default or weak SNMP credentials and exploits the legacy Cisco Smart Install feature (CVE-2018-0171, CVSS 9.8) and web-portal flaws to gain persistent control of edge network devices. The UK and EU formally attributed a destructive 29 December 2025 attack on Poland's energy sector — which deployed the previously undocumented DynoWiper malware against OT/ICS equipment at renewable and combined-heat-and-power sites and risked cutting power to up to 500,000 civilians — to Russian military/intelligence cyber actors operating in this same ecosystem.

- **Published:** 2026-07-13T00:00:00Z
- **Last reviewed:** 2026-07-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1283
- **ID:** TL-2026-1283
- **Severity:** HIGH (CVSS 9.8)
- **Category:** NATION_STATE
- **Status:** ACTIVE
- **Actor:** FSB Centre 16 (Russia)
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2018-0171

## Description

Centre 16 of Russia's Federal Security Service (FSB) — publicly tracked under the aliases Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard, and (per Cisco Talos) Static Tundra — is a long-running (10+ year) Russian state-sponsored cyber espionage operation specializing in the compromise of network infrastructure devices to gain durable footholds inside organizations of strategic interest to the Russian government. On 13 July 2026 the UK National Cyber Security Centre (NCSC), joined by 18 partner agencies across 12 countries (Australia, Canada, Czech Republic, Denmark, Estonia, Finland, France, Italy, New Zealand, Poland, Sweden, and the United States), published a joint advisory warning that the group is actively targeting the communications, defence, energy, financial services, government, and healthcare sectors.

The actor's primary access technique is internet-wide scanning for routers and switches still configured with default or weak SNMP (Simple Network Management Protocol) community strings and passwords, most commonly SNMPv1/v2 configurations lacking authentication or encryption. Where SNMP access alone is insufficient, the actor pivots to exploiting well-documented Cisco device vulnerabilities, most notably CVE-2018-0171, a CVSS 9.8 critical flaw in the Cisco IOS/IOS XE Smart Install (SMI) feature that allows an unauthenticated remote attacker to send crafted Smart Install messages to TCP port 4786 to trigger a device reload, cause an indefinite loop, or achieve arbitrary code execution due to inadequate packet validation (CWE-787 out-of-bounds write / CWE-20 improper input validation). Cisco patched CVE-2018-0171 in March 2018 and it has been on the CISA Known Exploited Vulnerabilities (KEV) catalog since November 2021, yet Static Tundra continues to find and compromise unpatched, end-of-life devices with Smart Install still enabled. The group additionally abuses unspecified Cisco web-management-portal vulnerabilities to gain device control.

Once a device is compromised, the actor's exploitation chain enables a TFTP server on the target and retrieves the running/startup configuration, harvesting SNMP community strings, local credentials, and network topology data. Persistence is established through compromised/newly-created privileged local accounts, additional read-write SNMP community strings, modification of TACACS+ configuration and ACLs to evade detection, and — per Talos's historical tracking — the SYNful Knock modular Cisco IOS firmware implant (first publicly documented in 2015), which survives reboots and grants remote access via a crafted 'magic packet' TCP SYN. The actor uses spoofed source IP addresses during SNMP command execution to complicate attribution and evade network monitoring, performs internal discovery via native device commands (e.g. 'show cdp neighbors') and by consuming Shodan/Censys scan data, establishes GRE tunnels and captures NetFlow data for traffic collection, and exfiltrates configuration data over TFTP, FTP, RCP, and the Cisco CISCO-CONFIG-COPY-MIB.

On 29 December 2025, a coordinated destructive cyber campaign hit at least thirty Polish wind and photovoltaic generation sites, a major combined heat and power (CHP) plant, and a manufacturing company. Per CERT Polska's incident report, the intrusion combined a long period of infiltration, theft of sensitive data, compromise of privileged Active Directory accounts, and unrestricted lateral movement, culminating in deployment of a previously undocumented wiper — DynoWiper (also identified as Win32/KillFiles.NMO) — intended to irreversibly destroy data on internal-network devices. Initial access to the OT/ICS environment was gained through vulnerable internet-facing edge devices. The attackers reached and damaged Hitachi RTU 560 remote terminal units, Mikronika controllers, ABB Relion 650 protection IEDs, Moxa NPort serial servers, and Windows-based HMIs and domain controllers. At the renewable-energy sites the attack did not halt electricity generation but severed communication with distribution system operators (DSOs) and removed remote supervisory control at the grid-connection layer, demonstrating that strategic OT impact can be achieved without an immediate blackout. At the CHP plant, deployed EDR tooling blocked activation of the wiper before it could execute its destructive payload. The UK and EU formally attributed the attack to Russian FSB-linked cyber actors, publicly noting that a fully successful attack could have caused up to 500,000 civilians to lose electricity; open-source technical reporting (CERT Polska, Dragos, The Hacker News) separately attributes the DynoWiper payload and OT-focused intrusion to Sandworm-associated (ELECTRUM) tradecraft, reflecting the well-documented overlap and shared infrastructure/tooling between Russian military (GRU-linked Sandworm) and FSB (Centre 16 / Static Tundra / Berserk Bear) offensive cyber units targeting the same strategic sectors.

## MITRE ATT&CK

- T1595.001 Scanning IP Blocks
- T1590 Gather Victim Network Information
- T1583.003 Virtual Private Server
- T1587.001 Malware
- T1190 Exploit Public-Facing Application
- T1078.001 Default Accounts
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1601.001 Patch System Image
- T1136.001 Local Account
- T1098 Account Manipulation
- T1078.001 Default Accounts
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1599 Network Boundary Bridging
- T1552 Unsecured Credentials
- T1110 Brute Force
- T1046 Network Service Discovery
- T1018 Remote System Discovery
- T1021 Remote Services
- T1602 Data from Configuration Repository
- T1560 Archive Collected Data
- T1090 Proxy
- T1071 Application Layer Protocol
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1485 Data Destruction
- T1561 Disk Wipe
- T1489 Service Stop

## Sources

- [UK and allies urge critical sectors to improve defences against Russian intelligence targeting](https://www.ncsc.gov.uk/news/uk-and-allies-urge-critical-sectors-to-improve-defences-against-russian-intelligence-targeting)
- [EU and UK officially blame Russian spies for cyberattack on Poland's power grid](https://www.theregister.com/security/2026/07/13/uk-eu-officially-pin-poland-energy-cyberattack-on-russia/5270458)
- [Poland Energy Sector Cyber Incident Highlights OT and ICS Security Gaps](https://www.cisa.gov/news-events/alerts/2026/02/10/poland-energy-sector-cyber-incident-highlights-ot-and-ics-security-gaps)
- [Russian state-sponsored espionage group Static Tundra compromises unpatched end-of-life network devices](https://blog.talosintelligence.com/static-tundra/)
- [Static Tundra Analysis & CVE-2018-0171 Detection Guide](https://www.splunk.com/en_us/blog/security/cve-2018-0171-static-tundra-smart-install-detection-guide.html)
- [FBI Warns FSB-Linked Hackers Exploiting Unpatched Cisco Devices for Cyber Espionage](https://thehackernews.com/2025/08/fbi-warns-russian-fsb-linked-hackers.html)
- [New DynoWiper Malware Used in Attempted Sandworm Attack on Polish Power Sector](https://thehackernews.com/2026/01/new-dynowiper-malware-used-in-attempted.html)
- [Energy Sector Incident Report - 29 December 2025](https://cert.pl/en/posts/2026/01/incident-report-energy-sector-2025/)
- [Poland Power Grid Attack: ELECTRUM Targets Distributed Energy](https://www.dragos.com/blog/poland-power-grid-attack-electrum-targets-distributed-energy-2025)
- [Cisco Security Advisory: Cisco Smart Install Remote Code Execution (cisco-sa-20180328-smi2)](https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2)
- [CISA Known Exploited Vulnerabilities Catalog — CVE-2018-0171](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-0171)
- [CERT Polska details cyberattacks on Polish manufacturer, energy sites](https://industrialcyber.co/industrial-cyber-attacks/cert-polska-details-cyberattacks-on-polish-manufacturer-energy-sites-fails-to-disrupt-power-and-heat-supply/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1283