# CISA AA26-194A: Russian State-Sponsored (FSB Center 16) Exploitation of Misconfigured Cisco Routers via SNMP and Smart Install (CVE-2018-0171, CVE-2008-4128)

> CISA, NSA, FBI, DC3 and international partners published AA26-194A on 2026-07-13, warning that FSB Center 16 actors (Static Tundra / Berserk Bear / Energetic Bear / Dragonfly) continue to compromise poorly configured and unsupported networking devices worldwide. The primary method is SNMP abuse with default community strings to exfiltrate router configurations over TFTP, with secondary exploitation of Cisco Smart Install (CVE-2018-0171) and CVE-2008-4128 on end-of-life devices.

- **Published:** 2026-10-31T18:53:49Z
- **Last reviewed:** 2026-10-31T18:53:49Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4922
- **ID:** TL-2026-4922
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** FSB Center 16 (Russia)
- **Detections:** 9 · **IOCs:** 5 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2018-0171, CVE-2008-4128

## Description

AA26-194A, "Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting", was released on 2026-07-13 by NSA, CISA, FBI and DC3, together with Five Eyes and European partners. It attributes ongoing, decade-long targeting of networking devices to cyber actors of the Russian Federal Security Service (FSB) Center 16. Industry names for the same activity include Static Tundra (Cisco Talos), Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly and Ghost Blizzard. Targeted sectors named in the advisory are communications, the defense industrial base, energy, financial services, government services (especially state and local) and healthcare and public health.

The main technique needs no exploit. Operators scan for routers with an exposed SNMP agent that accepts default or common community strings. They then send SNMP Set-Requests from a spoofed source IP, through proxies. The requests write to the CISCO-CONFIG-COPY-MIB (ccCopyTable, OID 1.3.6.1.4.1.9.9.96.1.1) with protocol TFTP, source running-config, destination networkFile, the attacker's server address, and RowStatus createAndGo, which starts the transfer immediately. Configuration files, typically named config.bkp or output.txt, are sent by TFTP to actor-controlled servers. Stolen configurations expose local credentials and SNMP community strings, and weak Cisco hash types (type 0/7 reversible, type 4 unsalted SHA-256, type 5 salted MD5) make offline recovery practical. This enables follow-on access to other devices.

Secondary access methods are Cisco Smart Install abuse via CVE-2018-0171 (TCP 4786 buffer overflow; CVSS 9.8; unauthenticated remote reload or code execution) and CVE-2008-4128 (HTTP administration CSRF on Cisco IOS 12.4, model 871 ISR, end-of-life devices only; added to CISA KEV on 2026-07-13). Post-compromise activity documented in the technical analysis includes creating local accounts for Telnet re-entry, weakening TACACS+ logging, and building GRE tunnels to intercept traffic. Historical context: Dragonfly/Havex ICS supply-chain trojanization (2012-2014), Dragonfly 2.0 energy-sector intrusions (2014-2017), the SYNful Knock Cisco IOS implant (2015) and Static Tundra's aggressive CVE-2018-0171 exploitation (2021-present, escalating against Ukraine and allies after February 2022).

The advisory publishes no IP addresses, domains or file hashes, so detection relies on behavior: inbound SNMP Set-Requests touching 1.3.6.1.4.1.9.9.96.*, outbound TFTP from routers, Smart Install traffic on TCP 4786, unexpected config-copy events, new local accounts, GRE tunnels and gaps in syslog, AAA or NetFlow data. The advisory does not give a model or version list beyond the CVE-specific scope. This record was built from the CISA advisory text as summarized by secondary sources; the primary PDF could not be parsed directly.

## MITRE ATT&CK

- T1595.001 Scanning IP Blocks
- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1078.001 Default Accounts
- T1569 System Services
- T1098 Account Manipulation
- T1003 OS Credential Dumping
- T1027 Obfuscated Files or Information
- T1021 Remote Services
- T1602.001 SNMP (MIB Dump)
- T1602.002 Network Device Configuration Dump
- T1090 Proxy
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

## Sources

- [CISA AA26-194A: Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-194a)
- [IC3/FBI CSA: Improve Router Hygiene (PDF)](https://www.ic3.gov/CSA/2026/260713.pdf)
- [NSA and Partners Release Guidance on Improving Router Hygiene](https://nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4541059/nsa-and-partners-release-guidance-on-improving-router-hygiene-to-protect-agains/)
- [ASD/ACSC: Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting (PDF)](https://www.cyber.gov.au/sites/default/files/2026-07/Improve%20Router%20Hygiene%20to%20Protect%20Against%20Russian%20State-Sponsored%20Targeting.pdf)
- [NCSC NZ: Improve router hygiene to protect against Russian state-sponsored targeting](https://www.ncsc.govt.nz/alerts/improve-router-hygiene-to-protect-against-russian-state-sponsored-targeting)
- [Picus Security: FSB Center 16 - How Russian hackers exploit routers via SNMP and Cisco Smart Install](https://www.picussecurity.com/resource/blog/fsb-center-16-how-russian-hackers-exploit-routers-via-snmp-and-cisco-smart-install)
- [AttackIQ: Response to CISA Advisory AA26-194A](https://www.attackiq.com/2026/07/15/response-to-aa26-194a/)
- [Qualys: Operationalizing CISA AA26-194A - Automating Cisco Router Security Assessments with Policy Audit](https://blog.qualys.com/product-tech/2026/10/30/cisa-aa26-194a-cisco-router-policy-audit)
- [WaterISAC: CISA and Partners Urge Improved Router Hygiene to Counter Russian State-Sponsored Targeting](https://www.waterisac.org/tlpclear-cisa-and-partners-urge-improved-router-hygiene-to-counter-russian-state-sponsored-targeting)
- [ProCircular: Five Fixes for Russia's FSB Scanning Routers This Week](https://blog.procircular.com/five-fixes-for-russias-fsb-scanning-routers-this-week)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4922