Threat reportAPTTL-2026-4922
CISA AA26-194A: Russian State-Sponsored (FSB Center 16) Exploitation of Misconfigured Cisco Routers via SNMP and Smart Install (CVE-2018-0171, CVE-2008-4128)
CISA AA26-194A (TL-2026-4922), also tracked as AA26-194A, is a high-severity advanced persistent threat campaign, first published 2026-10-31. It is attributed to FSB Center 16 (Russia) with high confidence, affects Cisco IOS / IOS XE with Smart Install enabled (CVE-2018-0171), references 2 CVEs (CVE-2018-0171, CVE-2008-4128), maps to 13 MITRE ATT&CK techniques (T1003, T1021, T1027), and is covered by 9 detection rules and 5 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 13MITRE ATT&CK
- Actors
- 2FSB Center 16
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 5Indicators of compromise
Key facts for TL-2026-4922
- Threat ID
- TL-2026-4922
- Also known as
- AA26-194A, Router Hygiene Advisory, Static Tundra
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution
- FSB Center 16, Static Tundra
- Attribution confidence
- HIGH
- Nation-state nexus
- Russia
- Motivation
- ESPIONAGE
- Target sectors
- communications, defense industrial base, energy, financial services, government administration, health
- Target regions
- Global, North America, Europe, ukraine
- Detection rules
- 9
- Indicators of compromise
- 5
Malware and tooling in CISA AA26-194A
Malware and tooling: Backdoor.Oldrea - S0093, SYNful Knock - S0519
How CISA AA26-194A works
CISA, NSA, FBI, DC3 and international partners published AA26-194A on 2026-07-13, warning that FSB Center 16 actors (Static Tundra / Berserk Bear / Energetic Bear / Dragonfly) continue to compromise poorly configured and unsupported networking devices worldwide. The primary method is SNMP abuse with default community strings to exfiltrate router configurations over TFTP, with secondary exploitation of Cisco Smart Install (CVE-2018-0171) and CVE-2008-4128 on end-of-life devices.
AA26-194A, "Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting", was released on 2026-07-13 by NSA, CISA, FBI and DC3, together with Five Eyes and European partners. It attributes ongoing, decade-long targeting of networking devices to cyber actors of the Russian Federal Security Service (FSB) Center 16. Industry names for the same activity include Static Tundra (Cisco Talos), Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly and Ghost Blizzard. Targeted sectors named in the advisory are communications, the defense industrial base, energy, financial services, government services (especially state and local) and healthcare and public health.
The main technique needs no exploit. Operators scan for routers with an exposed SNMP agent that accepts default or common community strings. They then send SNMP Set-Requests from a spoofed source IP, through proxies. The requests write to the CISCO-CONFIG-COPY-MIB (ccCopyTable, OID 1.3.6.1.4.1.9.9.96.1.1) with protocol TFTP, source running-config, destination networkFile, the attacker's server address, and RowStatus createAndGo, which starts the transfer immediately. Configuration files, typically named config.bkp or output.txt, are sent by TFTP to actor-controlled servers. Stolen configurations expose local credentials and SNMP community strings, and weak Cisco hash types (type 0/7 reversible, type 4 unsalted SHA-256, type 5 salted MD5) make offline recovery practical. This enables follow-on access to other devices.
Secondary access methods are Cisco Smart Install abuse via CVE-2018-0171 (TCP 4786 buffer overflow; CVSS 9.8; unauthenticated remote reload or code execution) and CVE-2008-4128 (HTTP administration CSRF on Cisco IOS 12.4, model 871 ISR, end-of-life devices only; added to CISA KEV on 2026-07-13). Post-compromise activity documented in the technical analysis includes creating local accounts for Telnet re-entry, weakening TACACS+ logging, and building GRE tunnels to intercept traffic. Historical context: Dragonfly/Havex ICS supply-chain trojanization (2012-2014), Dragonfly 2.0 energy-sector intrusions (2014-2017), the SYNful Knock Cisco IOS implant (2015) and Static Tundra's aggressive CVE-2018-0171 exploitation (2021-present, escalating against Ukraine and allies after February 2022).
The advisory publishes no IP addresses, domains or file hashes, so detection relies on behavior: inbound SNMP Set-Requests touching 1.3.6.1.4.1.9.9.96.*, outbound TFTP from routers, Smart Install traffic on TCP 4786, unexpected config-copy events, new local accounts, GRE tunnels and gaps in syslog, AAA or NetFlow data. The advisory does not give a model or version list beyond the CVE-specific scope. This record was built from the CISA advisory text as summarized by secondary sources; the primary PDF could not be parsed directly.
MITRE ATT&CK techniques used in TL-2026-4922
Credential Access
Lateral Movement
Defense Evasion
T1027 Obfuscated Files or Information
Exfiltration
T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
Initial Access
T1078.001 Default Accounts; T1190 Exploit Public-Facing Application
Command and Control
Persistence
Execution
Reconnaissance
T1595.001 Scanning IP Blocks; T1595.002 Vulnerability Scanning
Collection
T1602.001 SNMP (MIB Dump); T1602.002 Network Device Configuration Dump
Affected products and versions in CISA AA26-194A
- Cisco — IOS / IOS XE with Smart Install enabled (CVE-2018-0171)
Vulnerable versions: Devices with Smart Install client enabled and unpatched
Fixed in: Cisco fixed releases per vendor advisory for CVE-2018-0171 - Cisco — IOS 12.4 on 871 Integrated Services Router (CVE-2008-4128)
Vulnerable versions: End-of-life devices - Cisco — Routers and network devices exposing SNMPv1/v2c with default or weak community strings
Vulnerable versions: Configuration-dependent; no specific versions in advisory
Fixed in: Reconfigure to SNMPv3 authPriv
Remediation for CISA AA26-194A
Patches
- Apply Cisco fixes for CVE-2018-0171
- Replace end-of-life Cisco IOS 12.4 devices affected by CVE-2008-4128 (no fix; end-of-life)
Immediate actions
- Disable Cisco Smart Install on every device (no vstack) and block TCP 4786 at the edge
- Block UDP 69 (TFTP), UDP 161/162 (SNMP) and TCP/UDP 10161/10162 from untrusted networks
- Disable SNMPv1/v2c and remove default or common community strings
- Review router configs, local accounts, GRE tunnels, TACACS+ settings and ACLs for unauthorized changes
Workarounds
- Where Smart Install cannot be removed, restrict TCP 4786 to the director/management network with ACLs
- Remove unnecessary services and strengthen password and authentication controls
Longer-term hardening
- Migrate to SNMPv3 with authPriv and apply deny-by-default SNMP view/MIB allow-lists
- Restrict management protocols to out-of-band management networks via ACLs
- Re-hash credentials to Cisco type 8 or 9 and eliminate type 0, 4, 5 and 7
- Centralize configuration management and baseline syslog, AAA and NetFlow to spot logging gaps
- Retire unsupported and end-of-life devices
CVEs associated with CISA AA26-194A
Weaknesses (CWE) in CISA AA26-194A
Timeline of CISA AA26-194A
- Dragonfly/Havex campaign begins (2012-2014): trojanized ICS/SCADA software updates, 17,000+ infections across ~135 countries, energy sector focus. Date is year-level.
- Dragonfly 2.0 (2014-2017): direct targeting of energy operators, including Wolf Creek Nuclear Operating Corporation business systems. Date is year-level.
- SYNful Knock modular Cisco IOS firmware implant disclosed by Mandiant; persists across reboots and activates on a crafted TCP SYN; deployed with default or stolen credentials. Date is year-level.
- Cisco discloses CVE-2018-0171, an unauthenticated Smart Install buffer overflow (TCP 4786); ~250,000 vulnerable devices and ~8.5M with the port exposed at disclosure.
- Static Tundra activity (Cisco Talos tracking) begins aggressive CVE-2018-0171 exploitation. Date is year-level.
- Escalation of FSB Center 16 router targeting against Ukraine and allies after February 2022.
- CISA adds CVE-2008-4128 to the Known Exploited Vulnerabilities catalog.
- NSA, CISA, FBI, DC3 and Five Eyes/European partners publish AA26-194A on FSB Center 16 router exploitation.
- AttackIQ publishes an emulation-focused response to AA26-194A.
- Qualys publishes guidance on automating Cisco router assessments against AA26-194A.
Sources cited for CISA AA26-194A
- CISA AA26-194A: Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting
- IC3/FBI CSA: Improve Router Hygiene (PDF)
- NSA and Partners Release Guidance on Improving Router Hygiene
- ASD/ACSC: Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting (PDF)
- NCSC NZ: Improve router hygiene to protect against Russian state-sponsored targeting
- Picus Security: FSB Center 16 - How Russian hackers exploit routers via SNMP and Cisco Smart Install
- AttackIQ: Response to CISA Advisory AA26-194A
- Qualys: Operationalizing CISA AA26-194A - Automating Cisco Router Security Assessments with Policy Audit
- WaterISAC: CISA and Partners Urge Improved Router Hygiene to Counter Russian State-Sponsored Targeting
- ProCircular: Five Fixes for Russia's FSB Scanning Routers This Week
Detection coverage for TL-2026-4922
As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4922 across Splunk SPL, Microsoft KQL and Sigma, covering 5 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.