# FSB Center 16 (Static Tundra) Exploits SNMP Config Exfiltration and Cisco Smart Install RCE (CVE-2018-0171) Against Routers

> Russia's FSB Center 16, tracked as Static Tundra (aka Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard), abuses weak/default SNMP community strings to exfiltrate Cisco router configs via TFTP and exploits the unauthenticated Cisco Smart Install buffer overflow (CVE-2018-0171) for RCE. Campaign spans a decade of critical-infrastructure targeting, incl. exploitation of CVE-2018-0171 by Salt Typhoon (Feb 2025) and a December 2025 attack on Poland's power grid formally attributed by UK/EU on 2026-07-13.

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1312
- **ID:** TL-2026-1312
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** FSB Center 16 (Russia)
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2018-0171, CVE-2008-4128

## Description

Static Tundra is a Russian state-sponsored cyber espionage group operated by FSB Center 16 (Military Unit 71330), publicly documented by Cisco Talos in August 2025 and jointly attributed by CISA, NSA, FBI, and international partners in advisory AA26-194A (July 13, 2026). Talos assesses with high confidence that Static Tundra is a sub-cluster of the long-running 'Energetic Bear'/'Berserk Bear' activity cluster, historically tracked by industry as Dragonfly, Crouching Yeti, and (by Microsoft) Ghost Blizzard, and with moderate confidence links the group to the 2015-era SYNful Knock firmware implant.

The group's signature technique combines two legitimate Cisco management functions turned malicious: (1) abusing weak or default SNMP community strings to issue SNMP Set-Requests against the CISCO-CONFIG-COPY-MIB (OID 1.3.6.1.4.1.9.9.96), instructing a router to copy its own running-config to an attacker-controlled TFTP server, harvesting embedded local credentials and additional SNMP strings for lateral movement; and (2) exploiting CVE-2018-0171, an unauthenticated buffer overflow in the Cisco IOS/IOS XE Smart Install feature (TCP/4786, patched March 2018 via cisco-sa-20180328-smi2, CVSS 9.8), against unpatched or end-of-life switches to gain arbitrary code execution or force reload/DoS. Post-compromise, operators create local accounts, enable Telnet, weaken TACACS+ logging, and build GRE tunnels to redirect and collect NetFlow/traffic of interest, and in some cases deployed the SYNful Knock IOS image implant for persistence across reboots.

Targeting has spanned telecommunications, higher education, manufacturing, energy, defense, financial services, government, and healthcare across North America, Asia, Africa, and Europe, with escalated operations against Ukrainian entities since 2022. The decade-old CVE-2018-0171 flaw was independently confirmed by Cisco Talos to have also been exploited by Salt Typhoon (China-linked) in February 2025, underscoring how unpatched legacy Cisco infrastructure remains a shared attack surface across multiple nation-state actors. On 29 December 2025, coordinated destructive attacks struck more than 30 Polish wind/solar farms and a combined heat-and-power plant serving roughly half a million customers; CERT Polska found infrastructure overlap with Static Tundra/Berserk Bear/Dragonfly, and UK and EU governments formally attributed the intrusion to Static Tundra/FSB Center 16 with high confidence on 2026-07-13 (though ESET and Dragos separately assessed the destructive wiper component with moderate confidence to Sandworm). CISA added the related legacy flaw CVE-2008-4128 (Cisco IOS 12.4 CSRF in the HTTP administration interface, CWE-352) to its Known Exploited Vulnerabilities catalog on 2026-07-13, the same day AA26-194A was published, with a federal remediation deadline of 2026-07-16 under BOD 22-01.

## MITRE ATT&CK

- T1595 Active Scanning
- T1590 Gather Victim Network Information
- T1583 Acquire Infrastructure
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1136 Create Account
- T1601 Modify System Image
- T1584 Compromise Infrastructure
- T1068 Exploitation for Privilege Escalation
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1600 Weaken Encryption
- T1552 Unsecured Credentials
- T1040 Network Sniffing
- T1110 Brute Force
- T1046 Network Service Discovery
- T1016 System Network Configuration Discovery
- T1087 Account Discovery
- T1021 Remote Services
- T1210 Exploitation of Remote Services
- T1119 Automated Collection
- T1602 Data from Configuration Repository
- T1090 Proxy
- T1572 Protocol Tunneling
- T1048 Exfiltration Over Alternative Protocol
- T1041 Exfiltration Over C2 Channel
- T1485 Data Destruction
- T1498 Network Denial of Service
- T1529 System Shutdown/Reboot

## Sources

- [Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting (AA26-194A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-194a)
- [CSA_IMPROVE_ROUTER_HYGIENE.PDF (Joint Cybersecurity Advisory, TLP:CLEAR)](https://media.defense.gov/2026/Jul/09/2003959498/-1/-1/0/CSA_IMPROVE_ROUTER_HYGIENE.PDF)
- [FSB Center 16: How Russian Hackers Exploit Routers via SNMP and Cisco Smart Install](https://www.picussecurity.com/resource/blog/fsb-center-16-how-russian-hackers-exploit-routers-via-snmp-and-cisco-smart-install)
- [Static Tundra: Russian state-sponsored espionage group compromises unpatched end-of-life network devices](https://blog.talosintelligence.com/static-tundra/)
- [Russian Government Cyber Actors Targeting Networking Devices, Critical Infrastructure (FBI Alert)](https://www.fbi.gov/investigate/cyber/alerts/2025/russian-government-cyber-actors-targeting-networking-devices-critical-infrastructure)
- [IC3 PSA-250820: Russian Government Cyber Actors Targeting Networking Devices, Critical Infrastructure](https://www.ic3.gov/PSA/2025/PSA250820)
- [Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability (cisco-sa-20180328-smi2)](https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20180328-smi2.html)
- [CVE-2018-0171 Detail - NVD](https://nvd.nist.gov/vuln/detail/cve-2018-0171)
- [CVE-2008-4128 Detail - NVD](https://nvd.nist.gov/vuln/detail/cve-2008-4128)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [CISA adds Cisco IOS flaw to known exploited vulnerabilities catalog](https://www.scworld.com/brief/cisa-adds-cisco-ios-flaw-to-known-exploited-vulnerabilities-catalog)
- [Energy Sector Incident Report - 29 December 2025 (CERT Polska)](https://cert.pl/en/posts/2026/01/incident-report-energy-sector-2025/)
- [CERT Polska Details Coordinated Cyber Attacks on 30+ Wind and Solar Farms](https://thehackernews.com/2026/01/poland-attributes-december-cyber.html)
- [CERT Polska: Static Tundra behind coordinated Poland critical infrastructure hack](https://www.scworld.com/brief/cert-polska-static-tundra-behind-coordinated-poland-critical-infrastructure-hack)
- [Poland Power Grid Attack: ELECTRUM Targets Distributed Energy](https://www.dragos.com/blog/poland-power-grid-attack-electrum-targets-distributed-energy-2025)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1312