FSB Center 16 exploits misconfigured SNMP and Cisco routers across critical sectors, joint advisory warns
A joint advisory (AA26-194a) from NSA, CISA, FBI, DC3 and 15 allied agencies warns that Russian FSB Center 16 cyber actors continue to opportunistically compromise poorly configured and vulnerable networking devices worldwide, primarily routers. The advisory builds on the FBI's August 2025 PSA on the decade-plus campaign and adds TTPs. Government services (especially state and local) and healthcare and public health are the critical infrastructure sectors most at risk. The actors mainly abuse SNMP agents that accept default or common community strings, and occasionally exploit Cisco CVEs and Cisco Smart Install. The agencies note overlap with TTPs used by other actors such as Salt Typhoon, so the mitigations apply more broadly.
Technical Details
- The actors scan Internet IP ranges for SNMP agents accepting default or common community strings [T1595.001, T1595.002], using proxies.
- They send SNMP Set-Requests from a spoofed IP address [T1027] containing OIDs that make the device copy its configuration to a file, often named "config.bkp" or "output.txt" [T1003, T1602.002].
- The file is transferred, typically via TFTP, to an actor-controlled leased VPS or a compromised FTP server [T1583.003, T1090, T1071, T1048].
- Secondary methods are exploitation of Cisco CVEs, the Smart Install (SMI) feature and device web management portals [T1190, T1068, T1584.008, T1588.005]. CVE-2008-4128 is noted as affecting only end-of-life Cisco devices.
- Example OIDs to monitor: 1.3.6.1.4.1.9.9.96.1.1 (Cisco Config Copy) and 1.3.6.1.4.1.9.9.96.1.1.1.1.5 (Config Copy Server Address).
Remediation
- Disable Cisco Smart Install on all devices.
- Use SNMPv3 with authPriv and disable SNMPv1/v2. If they are unavoidable, change default community strings and allow read-only access only.
- Use strong, unique local passwords, with Cisco hash type 8 and no types 0, 4 or 7. Monitor local account logins and unusual credentials, and use centralized authentication with MFA.
- Restrict SNMP OIDs with a MIB allow list and write IDS rules for inbound SNMP Set-Requests targeting sensitive OIDs.
- Restrict management protocols with ACLs, preferably on an out-of-band network. Deny external traffic to UDP 69, TCP 4786, UDP 161/162 and TCP/UDP 10161/10162 unless mission critical.
- Patch network device firmware, replace end-of-life devices and use an attack surface management service.
Exploit público
Há código de exploração publicado no Exploit-DB para CVE-2008-4128. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.
-
Cisco Router - HTTP Administration Cross-Site Request Forgery / Command Execution (1)
This is a web page that abuses cross-site request forgery against the HTTP administration interface of Cisco routers (CVE-2008-4128). When a logged-in administrator visits the page, their browser automatically submits a form to the router's privileged command-execution handler. The attacker needs no credentials of their own, only a victim with an active session who can reach the router's web interface, and must know its address. The sample only runs a harmless status command, but the same method could run any privileged command. It is a simple, working proof of concept.
Linha do tempo
-
FSB Center 16 exploits misconfigured SNMP and Cisco routers across critical sectors, joint advisory warns
ler a análise desta fonte ocultar
A joint advisory (AA26-194a) from NSA, CISA, FBI, DC3 and 15 allied agencies warns that Russian FSB Center 16 cyber actors continue to opportunistically compromise poorly configured and vulnerable networking devices worldwide, primarily routers. The advisory builds on the FBI's August 2025 PSA on the decade-plus campaign and adds TTPs. Government services (especially state and local) and healthcare and public health are the critical infrastructure sectors most at risk. The actors mainly abuse SNMP agents that accept default or common community strings, and occasionally exploit Cisco CVEs and Cisco Smart Install. The agencies note overlap with TTPs used by other actors such as Salt Typhoon, so the mitigations apply more broadly.
Technical Details
- The actors scan Internet IP ranges for SNMP agents accepting default or common community strings [T1595.001, T1595.002], using proxies.
- They send SNMP Set-Requests from a spoofed IP address [T1027] containing OIDs that make the device copy its configuration to a file, often named "config.bkp" or "output.txt" [T1003, T1602.002].
- The file is transferred, typically via TFTP, to an actor-controlled leased VPS or a compromised FTP server [T1583.003, T1090, T1071, T1048].
- Secondary methods are exploitation of Cisco CVEs, the Smart Install (SMI) feature and device web management portals [T1190, T1068, T1584.008, T1588.005]. CVE-2008-4128 is noted as affecting only end-of-life Cisco devices.
- Example OIDs to monitor: 1.3.6.1.4.1.9.9.96.1.1 (Cisco Config Copy) and 1.3.6.1.4.1.9.9.96.1.1.1.1.5 (Config Copy Server Address).
Remediation
- Disable Cisco Smart Install on all devices.
- Use SNMPv3 with authPriv and disable SNMPv1/v2. If they are unavoidable, change default community strings and allow read-only access only.
- Use strong, unique local passwords, with Cisco hash type 8 and no types 0, 4 or 7. Monitor local account logins and unusual credentials, and use centralized authentication with MFA.
- Restrict SNMP OIDs with a MIB allow list and write IDS rules for inbound SNMP Set-Requests targeting sensitive OIDs.
- Restrict management protocols with ACLs, preferably on an out-of-band network. Deny external traffic to UDP 69, TCP 4786, UDP 161/162 and TCP/UDP 10161/10162 unless mission critical.
- Patch network device firmware, replace end-of-life devices and use an attack surface management service.