Multiple Russian state-sponsored APT groups, including Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard, and Static Tundra, are conducting cyberattacks targeting critical infrastructure routers globally. These actors scan for poorly secured devices and exploit known Cisco vulnerabilities (CVE-2008-4128 and CVE-2018-0171) to achieve arbitrary code execution. They use SNMP set-requests to instruct devices to copy configurations and transfer them over TFTP to attacker-controlled servers. The attacks affect critical infrastructure sectors such as communications, defense industrial base, energy, financial, government, and healthcare. The joint advisory from the US and allied nations recommends disabling Cisco Smart Install, disabling SNMPv1 and SNMPv2 in favor of SNMPv3 with encryption, securing credentials, restricting management protocol access, and patching devices to mitigate these threats.

Successful exploitation allows attackers to compromise critical infrastructure networking devices, potentially leading to unauthorized access, data exfiltration, and arbitrary code execution. This undermines the integrity and availability of critical infrastructure sectors including communications, defense, energy, finance, government, and healthcare. The compromise of routers can facilitate further network intrusion and disruption of essential services.

The joint advisory recommends disabling Cisco Smart Install on all devices and disabling SNMPv1 and SNMPv2 protocols, replacing them with SNMPv3 configured with modern encryption standards. Unique, securely stored passwords should be used for network device accounts. Access to SNMP Object Identifiers (OIDs) and management protocols should be restricted. External communications on specific ports should be denied at edge firewalls and devices. Network device software and firmware must be kept up to date to patch known vulnerabilities, including CVE-2008-4128 and CVE-2018-0171. The NSA has also published guidance on reducing SNMP abuse risk. These mitigations are currently the recommended measures; no official patch status is provided for all affected devices, so adherence to these best practices is critical.