In August 2025, the FBI through IC3 rolled out awarning: the cyber-operations of the Russian FSB from the Center 16division pulled configuration files from thousands of network devicesin the critical infrastructure sectors. Two vectors - SNMP andseven-year-old CVE-2018-0171in Cisco Smart Install. On some devices, the configurations were notjust downloaded, but modified for permanent unauthorized access.Intelligence in compromised networks showed the interest of attackersand applications related to industrial control systems.Russian-language top search results on request "APT-attack"is clogged with general descriptions of phishing chains and killchain at the working station level - no material does not disassemblethe specific tools of state groupings aimed at routers and switches(a common map of campaigns and the evolution of TTP in all vectors)fullmap of APT-groups 2025-2026) Let's see.
Router is the device through which all the traffic of the segmentpasses. Compromise of one border router gives the attacker threethings at the same time.
Passive traffic interception.No need to put agents on the end hosts - it is enough to modify ACLor configure mirroring to a controlled interface. All segment trafficis available for analysis without an endpoint. Quiet, clean,elegant.
A stable bridgehead outside of monitoring.There is no antivirus on the routers, no EDR agent, and logs arestored locally and rotated. The median time of detection of anattacker on the network is 11 days according to the Mandiant M-Trends2025, but for network devices this figure can be multiples of amultiple. No one is looking for an implant on a router if the hostsare clean. According to the CrowdStrike Global Threat Report 2025,79% of attacks in 2024 were carried out without malware - throughlegitimate tools and control protocols. A router controlled throughthe same CLI that uses the administrator is the ideal environment forthis approach.
The way to ICS/OT segment. Accordingto the FBI, the FSB Center 16, when compromising network devices, ispurposefully looking for protocols related to industrial controlsystems. The router at the border of IT and the OT segment is first apoint of reconnaissance, then pyot in the technology network. For thefuel and energy sector and critical infrastructure, this is afundamentally different level of threat: not data theft, but apotential impact on physical processes.
FSBCenter 16 is a unit of the Federal Security Service of Russia,tracked in open reports under several names. The FBI points out that"Berserk Bear" and "Dragonfly" belong to theseparate but related clusters of activity of this unit. Cisco Talostracks a linked cluster as "Static Tundra". Berserk Bearand Dragonfly are historical names from CrowdStrike and Symantec,related to the same or intersecting cluster.
What we knowfrom the FBI warning (IC3, August 2025):
This is not a one-time campaign or a targeted operation. This is asystem program of compromising the global network infrastructure thatstretches more than a decade. The group has accumulated expertise inworking with network equipment - from mass scanning to thedevelopment of fittings. Not zero-day in browsers, not phishing withmacros - but routers. Conscious choice.
The initial phase of the FSB Center 16 attack does not requirezero-day exploits. According to the joint CISA, the FBI and the NSA,the attackers use mass crawl to search for poorly configured networkdevices – primarily routers.
SNMP as an input vector.Simple Network Management Protocol versions 1 and 2 does not supportencryption. Community string is open. If the administrator has left adefault value public for reading orprivate For recording - the attackergets full access to the configuration of the device, and when youwrite-access, can modify it. According to MITRE ATT&CK, it is theEpllow Public-Facting Application (T1190,Initial Access) and Network Device Configuration Dump (T1602.002,Collection)
In practice, SNMP scanning is trivial:GetBulk-requests for UDP/161 across wide IP bands. Devices thatrespond to standard community strings are instantly included in thetarget list. Traffic is completely legitimate in terms of theprotocol and does not cause triggering on most IDS. That's all the"complex APT-attack" - snmpwalkwith default community string.
CVE-2018-0171- Cisco Smart Install. The second key vector. Thevulnerability affects Cisco IOS and IOS XE: incorrect packetvalidation allows an uncertified remote attacker to trigger a devicereboot (DoS) or execute arbitrary code.
Characteristics:
Smart Install listens to TCP/4786 by default and does not requireauthentication. Many administrators do not suspect that the serviceis active on their equipment. The vulnerability was disclosed in2018, PoC is publicly available - and the FBI records its operationof the FSB Center in 2024-2025. Seven years. Thousands of unstoppabledevices.
Predictions and limitations of the vector:CVE-2018-0171works only on devices with an active service Smart Instal. If novstack Configured - the vulnerability is unexploited. Ondevices with updated firmware (patched has been available since2018), the vector is closed. The main target audience is devices withend-of-life (EOL) software, for which updates are not released. TheFBI directly points to the EOL equipment as a priority goal of theFSB Center 16.
After gaining access, the group proceeds to consolidation.Technicians are lined up from simple to complex ones - each nextincreases the resistance of implantation.
Level 1 -configuration modification. The most basic method of fixing:through SNMP write access or Smart Install download a modifiedconfiguration. The attacker adds a new user with a privilege level15, changes the settings of the VTY line (removes authentication orexpands ACL), redirects TACACCS + / RADIUS authentication to acontrolled server. In terms of ATT&CK - Network DeviceAuthentication (T1556.004)in conjunction with Network Device CLI (T1059.008)According to the FBI, this option is fixed on compromised devices.After write memory Access isrebooted.
Level 2 - modification of the image of iOS.Patch System Image (T1601.001)- loading the modified image of the operating system to the device.SYNful Knock, publicly identified in 2015, a specific example: amodified IOS image performs an implant at each download. Detectionrequires comparing the hash of the loaded image with the referencevalue from Cisco. If you don't check the hashes, you won'tknow.
Level 3 - ROMMONKit. ROMMONKit(T1542.004) - modification of the download download ROMMON. Thedeepest level of persistence documented in MITRE ATT&CK fornetwork devices. The implant at the bootr level is experiencing aniOS update: even if the administrator flashes the device modified byROMMON remains. Detection requires the verification of the downloaderor physical access. This is a firmware level surgery.
Placein kill chain: Initial Access (SNMP/CVE-2018-0171)-> Execution (T1059.008,CLI-access) -> Persistence (T1556.004/ T1601.001/ T1542.004,modification auth/image/bootloader) -> further operations from thefixed bridgehead.
Mass collection of configurations (T1602.002)The main goal in the recorded campaigns. The Cisco IOS configurationcontains: complete network topology (interfaces, subnets, VLAN),accounts (Passwords 0/5/7/8/9, SNMP community strings, TACACS+ keys),access lists (ACL), routes (static, BGP/OSPF-py), VPN tunnelsettings. From one configuration file, an experienced analystrestores the segment scheme. Of the thousands of configurations - thearchitecture of the critical infrastructure of the wholecountry.
Reducing crypto resistance (T1600.001)Reduce Key Space is a forced duungrade of VPN tunnels encryption orSSH to weak algorithms. Intercepted traffic becomes decryptible. Thetechnique is especially dangerous on devices that terminatesite-to-site VPN.
Multi-level proxy (T1090.003)The compromised routers are proxy nodes. C2 traffic passes throughthe chain of legitimate network devices and becomes indistinguishablefrom normal traffic control traffic (SSH, SNMP, NETCONF). Attributionto a particular source is extremely difficult - each intermediaterouter masks the real address of the operator. Try to trace the chainof five routers in different jurisdictions.
Alleight technicians are documented in MITRE ATT&CK with link tonetwork device platforms. The FSB Center 16 uses them not inisolation, but as a link: T1190-> T1059.008-> T1556.004/ T1601.001/ T1542.004-> T1602.002-> T1090.003.Each stage logically follows from the previous one.
Standard monitoring tools - EDR, host SIEM-agents - do not work onrouters. Detection requires targeted action and understanding of whatto look for.
On Cisco IOS XE, built-in verificationmechanisms are available:
Code:
show platform integrity
verify /sha512 bootflash
ackages.conf
show platform integrity displays thestatus of verification of the integrity of hardware and softwarecomponents. verify /sha512 calculatesthe hash of the image for comparison with the benchmark from theCisco Downloads section. Discrepancy of hash - direct indicator PatchSystem Image (T1601.001)
Limitation:show platform integrity Not available onall platforms. On old iOS (not IOS XE) verify/md5 with a manual comparison. On EOL devices, these commandsmay be absent - then the only reliable method of verifying thefirmware is to load the image from the device and compare the hashoffline. Long, brood, but there are no other options.
ConfigurationAudit - regular comparison of running-config with a referencecopy. Specific compromise indicators:
Automation: RANCID, Oxidized or Ansible for periodic removal ofconfigurations and diff-comparisons with baseline. If diff shows thenew username fit 15, you have a problem.
Where to send logs: syslog from network equipment should bedelivered to a dedicated syslog server off-deachment. Local logs onthe router are easily cleaned by the attacking with privileged access- one team clear loggingThere's notrace. NetFlow from border routers to NTA system - to detectanomalous threads.
Why APT Groups Attack Routers
Router is the device through which all the traffic of the segmentpasses. Compromise of one border router gives the attacker threethings at the same time.
Passive traffic interception.No need to put agents on the end hosts - it is enough to modify ACLor configure mirroring to a controlled interface. All segment trafficis available for analysis without an endpoint. Quiet, clean,elegant.
A stable bridgehead outside of monitoring.There is no antivirus on the routers, no EDR agent, and logs arestored locally and rotated. The median time of detection of anattacker on the network is 11 days according to the Mandiant M-Trends2025, but for network devices this figure can be multiples of amultiple. No one is looking for an implant on a router if the hostsare clean. According to the CrowdStrike Global Threat Report 2025,79% of attacks in 2024 were carried out without malware - throughlegitimate tools and control protocols. A router controlled throughthe same CLI that uses the administrator is the ideal environment forthis approach.
The way to ICS/OT segment. Accordingto the FBI, the FSB Center 16, when compromising network devices, ispurposefully looking for protocols related to industrial controlsystems. The router at the border of IT and the OT segment is first apoint of reconnaissance, then pyot in the technology network. For thefuel and energy sector and critical infrastructure, this is afundamentally different level of threat: not data theft, but apotential impact on physical processes.
Who are FSB Center 16: Berserk Bear, Dragonfly, Static Tundra
FSBCenter 16 is a unit of the Federal Security Service of Russia,tracked in open reports under several names. The FBI points out that"Berserk Bear" and "Dragonfly" belong to theseparate but related clusters of activity of this unit. Cisco Talostracks a linked cluster as "Static Tundra". Berserk Bearand Dragonfly are historical names from CrowdStrike and Symantec,related to the same or intersecting cluster.
What we knowfrom the FBI warning (IC3, August 2025):
- More than ten years of continuous compromising network devices around the world
- Priority goals - devices that accept outdated unencrypted protocols: Smart Install and SNMP versions 1 and 2
- Castom toolkit - SYNful Knock malware was publicly identified in 2015, which the division deployed on certain Cisco devices
- Scale - in one year, the FBI recorded the collection of configuration files from thousands of network devices in the critical infrastructure sectors
This is not a one-time campaign or a targeted operation. This is asystem program of compromising the global network infrastructure thatstretches more than a decade. The group has accumulated expertise inworking with network equipment - from mass scanning to thedevelopment of fittings. Not zero-day in browsers, not phishing withmacros - but routers. Conscious choice.
Chain of attack on network equipment: from scanning to control
InitialAccess: SNMP scanning and CVE-2018-0171
The initial phase of the FSB Center 16 attack does not requirezero-day exploits. According to the joint CISA, the FBI and the NSA,the attackers use mass crawl to search for poorly configured networkdevices – primarily routers.
SNMP as an input vector.Simple Network Management Protocol versions 1 and 2 does not supportencryption. Community string is open. If the administrator has left adefault value public for reading orprivate For recording - the attackergets full access to the configuration of the device, and when youwrite-access, can modify it. According to MITRE ATT&CK, it is theEpllow Public-Facting Application (T1190,Initial Access) and Network Device Configuration Dump (T1602.002,Collection)
In practice, SNMP scanning is trivial:GetBulk-requests for UDP/161 across wide IP bands. Devices thatrespond to standard community strings are instantly included in thetarget list. Traffic is completely legitimate in terms of theprotocol and does not cause triggering on most IDS. That's all the"complex APT-attack" - snmpwalkwith default community string.
CVE-2018-0171- Cisco Smart Install. The second key vector. Thevulnerability affects Cisco IOS and IOS XE: incorrect packetvalidation allows an uncertified remote attacker to trigger a devicereboot (DoS) or execute arbitrary code.
Characteristics:
- Product: Cisco IOS and IOS XE
- Vector: remote, without authentication
- Public PoC: EDB-44451, published on March 29, 2018 (author - embedi), only implements crash/DoS. RCE-exploitation confirmed by CISA KEV, but there is no public work RCE-exploiter in EDB
- KEV status: included in the CISA Known Exploited Vulnerabilities catalog from November 3, 2021 - confirmation of active operation
Smart Install listens to TCP/4786 by default and does not requireauthentication. Many administrators do not suspect that the serviceis active on their equipment. The vulnerability was disclosed in2018, PoC is publicly available - and the FBI records its operationof the FSB Center in 2024-2025. Seven years. Thousands of unstoppabledevices.
Predictions and limitations of the vector:CVE-2018-0171works only on devices with an active service Smart Instal. If novstack Configured - the vulnerability is unexploited. Ondevices with updated firmware (patched has been available since2018), the vector is closed. The main target audience is devices withend-of-life (EOL) software, for which updates are not released. TheFBI directly points to the EOL equipment as a priority goal of theFSB Center 16.
Execution and Persistence: configuration modification and SYNfulKnock
After gaining access, the group proceeds to consolidation.Technicians are lined up from simple to complex ones - each nextincreases the resistance of implantation.
Level 1 -configuration modification. The most basic method of fixing:through SNMP write access or Smart Install download a modifiedconfiguration. The attacker adds a new user with a privilege level15, changes the settings of the VTY line (removes authentication orexpands ACL), redirects TACACCS + / RADIUS authentication to acontrolled server. In terms of ATT&CK - Network DeviceAuthentication (T1556.004)in conjunction with Network Device CLI (T1059.008)According to the FBI, this option is fixed on compromised devices.After write memory Access isrebooted.
Level 2 - modification of the image of iOS.Patch System Image (T1601.001)- loading the modified image of the operating system to the device.SYNful Knock, publicly identified in 2015, a specific example: amodified IOS image performs an implant at each download. Detectionrequires comparing the hash of the loaded image with the referencevalue from Cisco. If you don't check the hashes, you won'tknow.
Level 3 - ROMMONKit. ROMMONKit(T1542.004) - modification of the download download ROMMON. Thedeepest level of persistence documented in MITRE ATT&CK fornetwork devices. The implant at the bootr level is experiencing aniOS update: even if the administrator flashes the device modified byROMMON remains. Detection requires the verification of the downloaderor physical access. This is a firmware level surgery.
Placein kill chain: Initial Access (SNMP/CVE-2018-0171)-> Execution (T1059.008,CLI-access) -> Persistence (T1556.004/ T1601.001/ T1542.004,modification auth/image/bootloader) -> further operations from thefixed bridgehead.
Collection and C2: Damp Configurations and Multi-level Proxy
Mass collection of configurations (T1602.002)The main goal in the recorded campaigns. The Cisco IOS configurationcontains: complete network topology (interfaces, subnets, VLAN),accounts (Passwords 0/5/7/8/9, SNMP community strings, TACACS+ keys),access lists (ACL), routes (static, BGP/OSPF-py), VPN tunnelsettings. From one configuration file, an experienced analystrestores the segment scheme. Of the thousands of configurations - thearchitecture of the critical infrastructure of the wholecountry.
Reducing crypto resistance (T1600.001)Reduce Key Space is a forced duungrade of VPN tunnels encryption orSSH to weak algorithms. Intercepted traffic becomes decryptible. Thetechnique is especially dangerous on devices that terminatesite-to-site VPN.
Multi-level proxy (T1090.003)The compromised routers are proxy nodes. C2 traffic passes throughthe chain of legitimate network devices and becomes indistinguishablefrom normal traffic control traffic (SSH, SNMP, NETCONF). Attributionto a particular source is extremely difficult - each intermediaterouter masks the real address of the operator. Try to trace the chainof five routers in different jurisdictions.
FullTTP card on MITRE ATT&CK
Alleight technicians are documented in MITRE ATT&CK with link tonetwork device platforms. The FSB Center 16 uses them not inisolation, but as a link: T1190-> T1059.008-> T1556.004/ T1601.001/ T1542.004-> T1602.002-> T1090.003.Each stage logically follows from the previous one.
Detectionof commprehension of network equipment
Standard monitoring tools - EDR, host SIEM-agents - do not work onrouters. Detection requires targeted action and understanding of whatto look for.
Checking Image and Configuration Integrity
On Cisco IOS XE, built-in verificationmechanisms are available:
Code:
show platform integrity
verify /sha512 bootflash
ackages.confshow platform integrity displays thestatus of verification of the integrity of hardware and softwarecomponents. verify /sha512 calculatesthe hash of the image for comparison with the benchmark from theCisco Downloads section. Discrepancy of hash - direct indicator PatchSystem Image (T1601.001)
Limitation:show platform integrity Not available onall platforms. On old iOS (not IOS XE) verify/md5 with a manual comparison. On EOL devices, these commandsmay be absent - then the only reliable method of verifying thefirmware is to load the image from the device and compare the hashoffline. Long, brood, but there are no other options.
ConfigurationAudit - regular comparison of running-config with a referencecopy. Specific compromise indicators:
- New users with privilege level 15, not created by the administrator
- VTY line with disconnected authentication or advanced ACL
- SNMP community strings that do not match the documents approved
- Changes in TACACS+/RADIUS settings (new server, modified key)
- Tcl scripts in NVRAM executable through kronor EEM (Persistence)
- Non-standard ACL that allow incoming connections from unknown subnets
Automation: RANCID, Oxidized or Ansible for periodic removal ofconfigurations and diff-comparisons with baseline. If diff shows thenew username fit 15, you have a problem.
NetworkIndicators
- Incoming connections to TCP/4786 (Smart Install) from external IP - in normal SMI traffic only inside the LAN
- SNMP traffic (UDP/161, UDP/162) from addresses not owned by management-subnets
- Atypical GRE/IP-in-IP tunnels that do not match the documented topology
- SSH/Telnet sessions to control interfaces from illegitimate IP addresses
- Abnormally large volume of outgoing TFTP/SCP traffic from the device (indicator of unloading configuration)
Where to send logs: syslog from network equipment should bedelivered to a dedicated syslog server off-deachment. Local logs onthe router are easily cleaned by the attacking with privileged access- one team clear loggingThere's notrace. NetFlow from border routers to NTA system - to detectanomalous threads.
