Russia’s FSB-Linked Hackers Targeting Cisco Network Gear Used in Critical Infrastructure

- About Us
- Contact Us
- Editorial Calendar
- Careers
- The Cyber Express by Cyble Vulnerability Disclosure Policy
- Cyble Trust Portal
[](https://thecyberexpress.com/)
- [MagazineDownload](https://thecyberexpress.com/cybersecurity-magazine/ "Cybersecurity Magazine")
- Firewall Daily
* All
[](https://thecyberexpress.com/1200-arrested-operation-serengeti-2-0/)
[](https://thecyberexpress.com/csrf-flaw-cve-2025-8592/)
### 70,000 WordPress Sites Exposed by Inspiro Theme Security Flaw
[](https://thecyberexpress.com/cisa-warns-of-ics-vulnerabilities/)
### CISA Warns of Critical ICS Flaws in Siemens, Tigo Energy, and EG4 Equipment
[](https://thecyberexpress.com/black-hat-usa-2025-ciso-podcast-series-ep-2/)
### Black Hat USA 2025 CISO Podcast Series: Episode 2 Now Live
[](https://thecyberexpress.com/critical-cve-2025-9074-docker-vulnerability/)
### Critical Vulnerability in Docker Desktop Allows Malicious Containers to Access Host System
[](https://thecyberexpress.com/zero-day-patched-in-ios-18-6-2/)
### Apple Patches Zero-Day in iOS 18.6.2 After Targeted Exploits Involving Malicious Image Files
[](https://thecyberexpress.com/dom%e2%80%91based-extension-clickjacking/)
### DOM-Based Extension Clickjacking Exposes Millions of Password Manager Users to Credential Theft
[](https://thecyberexpress.com/russia-targeting-cisco-network-gear/)
### Russia’s FSB-Linked Hackers Targeting Cisco Network Gear Used in Critical Infrastructure
[](https://thecyberexpress.com/europol-reward-qilin-ransomware-group/)
### Europol Says $50k Reward on Qilin Ransomware Group Admins is Fake
### Trending Tags
* Apple
* All
[](https://thecyberexpress.com/black-hat-usa-2025-ciso-podcast-series-ep-2/)
### Black Hat USA 2025 CISO Podcast Series: Episode 2 Now Live
[](https://thecyberexpress.com/black-hat-usa-2025-ciso-series-episode-1/)
[](https://thecyberexpress.com/civil-penalty-over-2022-optus-data-breach/)
### Australian Information Commissioner Seeks Civil Penalty Action Over 2022 Optus Data Breach
[](https://thecyberexpress.com/uae-cybersecurity-council-flags-privacy-risks/)
### Think Before You Download: UAE Cybersecurity Council Issues Warning on Unverified Apps
[](https://thecyberexpress.com/romania-financial-scam-finance-minister/)
### Romania Warns of Financial Scam Impersonating its Newly Re-Appointed Minister of Finance
[](https://thecyberexpress.com/australia-adopts-ot-cybersecurity-standards/)
### Australia Adopts Global OT Cybersecurity Standards to Secure Energy, Water, and Smart Infrastructure
[](https://thecyberexpress.com/federal-contractor-pays-14m-to-settle-fraud/)
### Federal IT Contractor Pays $14.75 Million Fine to Settle Cyber Fraud Charges
[](https://thecyberexpress.com/us-lawmakers-introduce-no-adversarial-ai-act/)
### U.S. Lawmakers Target ‘Adversarial AI’ in Bipartisan Push to Fortify Federal Systems
[](https://thecyberexpress.com/uk-military-unveils-1b-digital-targeting-web/)
### UK Military Unveils £1B ‘Digital Targeting Web’
* All
* How to
* What is
[](https://thecyberexpress.com/top-countries-leading-cybersecurity-race-2025/)
### The Top 8 Countries Leading the Cyber Defense Race in 2025
[](https://thecyberexpress.com/link-building-secrets/)
### The Link Building Secrets Your Competitors Don’t Want You to Know
[](https://thecyberexpress.com/supply-chain-resilience-for-2025/)
### Supply Chain Resilience and Physical Security: Lessons for 2025
[](https://thecyberexpress.com/healthcare-cybersecurity-trends-of-2024/)
### Healthcare Cybersecurity: 2024 Was Tough, 2025 May Be Better
[](https://thecyberexpress.com/ceos-perspective-on-take-down-services/)
### Shield Your Organization: CEO’s Perspective on Take-Down Services
[](https://thecyberexpress.com/microsoft-mandatory-mfa-azure-sign-ins/)
### Microsoft Announces Mandatory MFA for Azure Sign-ins to Bolster Cloud Defenses
[](https://thecyberexpress.com/signal-proxy-to-bypass-blocks-in-russia/)
### How to Set Up Signal Proxy to Help Bypass Censorship in Russia and Venezuela
[](https://thecyberexpress.com/third-party-risk-management-in-healthcare/)
### Why Healthcare CISOs Must Prioritize Third-Party Risk Management
[](https://thecyberexpress.com/tips-to-protect-streaming-platforms/)
### Protect Your Streaming Accounts Now Before It’s Too Late
* All
* Budgets
* Startups
[](https://thecyberexpress.com/cyble-introduces-support-package-in-australia/)
### Cyble Launches Essential 8 Cybersecurity Support Package for Australian Financial Sector
[](https://thecyberexpress.com/starlink-outage-incident-or-cyberattack/)
### Starlink Outage Sparks Cyberattack Speculation—But SpaceX Says Software to Blame
[](https://thecyberexpress.com/replit-ai-agent-incident/)
### Replit AI Agent Deletes Codebase and Lies About It — CEO Issues Apology
[](https://thecyberexpress.com/any-intent-to-pay-a-ransom-uk-govt/)
### Any Intent to Pay a Ransom? UK Government Wants to Know
[](https://thecyberexpress.com/co-op-cyberattack-exposes-data-of-millions/)
### All Co-op Members Hit in April Cyberattack, CEO Breaks Silence
[](https://thecyberexpress.com/federal-contractor-pays-14m-to-settle-fraud/)
### Federal IT Contractor Pays $14.75 Million Fine to Settle Cyber Fraud Charges
[](https://thecyberexpress.com/uk-military-unveils-1b-digital-targeting-web/)
### UK Military Unveils £1B ‘Digital Targeting Web’
[](https://thecyberexpress.com/regeneron-acquire-23andme/)
### After Bankruptcy, 23andMe Finds a Buyer in Regeneron—But What Happens to Your Data?
[](https://thecyberexpress.com/australia-data-breaches-highest-this-decade/)
### Australia’s Data Breach Reporting Numbers Highest in Half a Decade
* Startups
* Budgets
* Research
* Podcast
* Webinar
[](#)No Result View All Result
- [MagazineDownload](https://thecyberexpress.com/cybersecurity-magazine/ "Cybersecurity Magazine")
- Firewall Daily
* All
[](https://thecyberexpress.com/1200-arrested-operation-serengeti-2-0/)
[](https://thecyberexpress.com/csrf-flaw-cve-2025-8592/)
### 70,000 WordPress Sites Exposed by Inspiro Theme Security Flaw
[](https://thecyberexpress.com/cisa-warns-of-ics-vulnerabilities/)
### CISA Warns of Critical ICS Flaws in Siemens, Tigo Energy, and EG4 Equipment
[](https://thecyberexpress.com/black-hat-usa-2025-ciso-podcast-series-ep-2/)
### Black Hat USA 2025 CISO Podcast Series: Episode 2 Now Live
[](https://thecyberexpress.com/critical-cve-2025-9074-docker-vulnerability/)
### Critical Vulnerability in Docker Desktop Allows Malicious Containers to Access Host System
[](https://thecyberexpress.com/zero-day-patched-in-ios-18-6-2/)
### Apple Patches Zero-Day in iOS 18.6.2 After Targeted Exploits Involving Malicious Image Files
[](https://thecyberexpress.com/dom%e2%80%91based-extension-clickjacking/)
### DOM-Based Extension Clickjacking Exposes Millions of Password Manager Users to Credential Theft
[](https://thecyberexpress.com/russia-targeting-cisco-network-gear/)
### Russia’s FSB-Linked Hackers Targeting Cisco Network Gear Used in Critical Infrastructure
[](https://thecyberexpress.com/europol-reward-qilin-ransomware-group/)
### Europol Says $50k Reward on Qilin Ransomware Group Admins is Fake
### Trending Tags
* Apple
* All
[](https://thecyberexpress.com/black-hat-usa-2025-ciso-podcast-series-ep-2/)
### Black Hat USA 2025 CISO Podcast Series: Episode 2 Now Live
[](https://thecyberexpress.com/black-hat-usa-2025-ciso-series-episode-1/)
[](https://thecyberexpress.com/civil-penalty-over-2022-optus-data-breach/)
### Australian Information Commissioner Seeks Civil Penalty Action Over 2022 Optus Data Breach
[](https://thecyberexpress.com/uae-cybersecurity-council-flags-privacy-risks/)
### Think Before You Download: UAE Cybersecurity Council Issues Warning on Unverified Apps
[](https://thecyberexpress.com/romania-financial-scam-finance-minister/)
### Romania Warns of Financial Scam Impersonating its Newly Re-Appointed Minister of Finance
[](https://thecyberexpress.com/australia-adopts-ot-cybersecurity-standards/)
### Australia Adopts Global OT Cybersecurity Standards to Secure Energy, Water, and Smart Infrastructure
[](https://thecyberexpress.com/federal-contractor-pays-14m-to-settle-fraud/)
### Federal IT Contractor Pays $14.75 Million Fine to Settle Cyber Fraud Charges
[](https://thecyberexpress.com/us-lawmakers-introduce-no-adversarial-ai-act/)
### U.S. Lawmakers Target ‘Adversarial AI’ in Bipartisan Push to Fortify Federal Systems
[](https://thecyberexpress.com/uk-military-unveils-1b-digital-targeting-web/)
### UK Military Unveils £1B ‘Digital Targeting Web’
* All
* How to
* What is
[](https://thecyberexpress.com/top-countries-leading-cybersecurity-race-2025/)
### The Top 8 Countries Leading the Cyber Defense Race in 2025
[](https://thecyberexpress.com/link-building-secrets/)
### The Link Building Secrets Your Competitors Don’t Want You to Know
[](https://thecyberexpress.com/supply-chain-resilience-for-2025/)
### Supply Chain Resilience and Physical Security: Lessons for 2025
[](https://thecyberexpress.com/healthcare-cybersecurity-trends-of-2024/)
### Healthcare Cybersecurity: 2024 Was Tough, 2025 May Be Better
[](https://thecyberexpress.com/ceos-perspective-on-take-down-services/)
### Shield Your Organization: CEO’s Perspective on Take-Down Services
[](https://thecyberexpress.com/microsoft-mandatory-mfa-azure-sign-ins/)
### Microsoft Announces Mandatory MFA for Azure Sign-ins to Bolster Cloud Defenses
[](https://thecyberexpress.com/signal-proxy-to-bypass-blocks-in-russia/)
### How to Set Up Signal Proxy to Help Bypass Censorship in Russia and Venezuela
[](https://thecyberexpress.com/third-party-risk-management-in-healthcare/)
### Why Healthcare CISOs Must Prioritize Third-Party Risk Management
[](https://thecyberexpress.com/tips-to-protect-streaming-platforms/)
### Protect Your Streaming Accounts Now Before It’s Too Late
* All
* Budgets
* Startups
[](https://thecyberexpress.com/cyble-introduces-support-package-in-australia/)
### Cyble Launches Essential 8 Cybersecurity Support Package for Australian Financial Sector
[](https://thecyberexpress.com/starlink-outage-incident-or-cyberattack/)
### Starlink Outage Sparks Cyberattack Speculation—But SpaceX Says Software to Blame
[](https://thecyberexpress.com/replit-ai-agent-incident/)
### Replit AI Agent Deletes Codebase and Lies About It — CEO Issues Apology
[](https://thecyberexpress.com/any-intent-to-pay-a-ransom-uk-govt/)
### Any Intent to Pay a Ransom? UK Government Wants to Know
[](https://thecyberexpress.com/co-op-cyberattack-exposes-data-of-millions/)
### All Co-op Members Hit in April Cyberattack, CEO Breaks Silence
[](https://thecyberexpress.com/federal-contractor-pays-14m-to-settle-fraud/)
### Federal IT Contractor Pays $14.75 Million Fine to Settle Cyber Fraud Charges
[](https://thecyberexpress.com/uk-military-unveils-1b-digital-targeting-web/)
### UK Military Unveils £1B ‘Digital Targeting Web’
[](https://thecyberexpress.com/regeneron-acquire-23andme/)
### After Bankruptcy, 23andMe Finds a Buyer in Regeneron—But What Happens to Your Data?
[](https://thecyberexpress.com/australia-data-breaches-highest-this-decade/)
### Australia’s Data Breach Reporting Numbers Highest in Half a Decade
* Startups
* Budgets
* Research
* Podcast
* Webinar
[](#)No Result View All Result [](#) [](https://thecyberexpress.com/)[](#)No Result View All Result Home Cyber News
Russia’s FSB-Linked Hackers Targeting Cisco Network Gear Used in Critical Infrastructure
========================================================================================
 by Mihir Bagwe August 21, 2025 in Cyber News, Cyber Warfare, Espionage, Firewall Daily [](#)0 [](https://thecyberexpress.com/wp-content/uploads/Static-Tundra-Energetic-Bear-1.webp) 604 SHARES 3.4k VIEWS Share on LinkedInShare on Twitter[](https://telegram.me/share/url?url=https%3A%2F%2Fthecyberexpress.com%2Frussia-targeting-cisco-network-gear%2F&text=Russia%E2%80%99s%20FSB-Linked%20Hackers%20Targeting%20Cisco%20Network%20Gear%20Used%20in%20Critical%20Infrastructure)[](https://www.facebook.com/sharer.php?u=https%3A%2F%2Fthecyberexpress.com%2Frussia-targeting-cisco-network-gear%2F)[](//api.whatsapp.com/send?text=Russia%E2%80%99s%20FSB-Linked%20Hackers%20Targeting%20Cisco%20Network%20Gear%20Used%20in%20Critical%20Infrastructure%0Ahttps%3A%2F%2Fthecyberexpress.com%2Frussia-targeting-cisco-network-gear%2F)[](https://www.linkedin.com/shareArticle?url=https%3A%2F%2Fthecyberexpress.com%2Frussia-targeting-cisco-network-gear%2F&title=Russia%E2%80%99s%20FSB-Linked%20Hackers%20Targeting%20Cisco%20Network%20Gear%20Used%20in%20Critical%20Infrastructure)[](#)
How often do you hear people talking about issues of legacy systems—especially in critical infrastructure environments? Here’s another example of how deeply rooted this issue is—legacy Cisco router infrastructure remains a Russian intelligence vault.
A new alert from the FBI and a detailed analysis from Cisco Talos reveal how a decade-old vulnerability, tracked as CVE-2018-0171, in Cisco’s Smart Install feature continues to fuel state-level espionage campaigns against critical infrastructure.
A Legacy Weakness with Persistent Danger
CISA flagged this vulnerability back in 2018, warning that Russian state-sponsored actors had exploited Cisco’s Smart Install and unencrypted management protocols like SNMP and Telnet to harvest network configurations, inject firmware, and control routers for intelligence collection and lateral exploitation.
That advisory revealed how unsecured GRE tunnels, SNMP, and TFTP were easy pathways for attackers to extract configuration files and password hashes from enterprise and SOHO devices. This compromised network infrastructure could be weaponized for traffic interception or even destructive operations, CISA had warned, at the time.
Fast forward to the latest advisory and these are no longer just theoretical risks. The tools and techniques of SNMP abuse, misconfigured routers, use of TFTP over UDP, still enable attackers to extract device configurations, carve network maps and enact persistent access with minimal visibility.
Also read: Urgent: CISA Flags Cisco Device Risks, Weak Passwords a Major Threat
Static Tundra’s Stealthy Campaign, Decade in the Making
Cisco Talos has now dubbed the threat actor exploiting this weakness as Static Tundra, a Russian-linked espionage group likely tied to FSB’s Center 16, also known as Energetic Bear. Talos assesses with high confidence that Static Tundra has spent years infiltrating unpatched or end-of-life Cisco network devices, particularly those with Smart Install enabled, and has done so across telecoms, higher education institutes and manufacturing in multiple continents.
Their techniques include:
- Exploiting CVE-2018-0171 to inject a TFTP-based fallback, retrieving startup configurations.
- Abusing SNMP, occasionally via spoofed source addresses, to retrieve credentials and enable [remote access](https://cyble.com/remote-access-trojan/ "remote access").
- Deploying the notorious SYNful Knock firmware implant to maintain stealth and resilience through reboots.
- Leveraging GRE tunnels and NetFlow collection to quietly exfiltrate traffic and intelligible metadata.
Talos notes the group operates with precision, picking targets aligned with shifting geopolitical priorities—particularly during the Ukraine conflict escalation. What’s more worrying is that the researchers observed many compromised devices remain infected as organizations still fail to patch or disable Smart Install feature, despite patches being available since 2018.
Real-World Risk Across Sectors and Borders
The combined findings show that the threat persists because of structural neglect. Unpatched firmware, enabled legacy features, and unmanaged network gear are the primary reasons. While CISA’s 2018 warning outlined the [risk](https://thecyberexpress.com/what-are-risks-in-cybersecurity/ "risk"), Talos confirms that attackers continue to harvest sensitive configuration data, creating long-term espionage footholds.
Sophisticated threat actors controlling key network infrastructure can manipulate traffic flows, enable command-and-control for hidden implants, and pivot laterally—transforming compromised routers into control hubs for broader attacks, [cyber](https://thecyberexpress.com/cyber-news/ "cyber") experts warned.
A Non-Negotiable Security Imperative
The risk as we said earlier isn’t hypothetical anymore. It’s ongoing and systemic. Here are some foundational steps every enterprise and critical infrastructure network must take, as per Talos researchers:
- Patch or disable Smart Install immediately—CVE-2018-0171 remains widely exploitable.
- Encrypt management channels, disable legacy protocols, harden SNMP and AAA policies.
- Profile router behavior via NetFlow, log monitoring, and IDS signature deployment.
- Maintain accurate device inventories and restrict remote access to critical appliances.
Static Tundra’s campaigns make clear that network devices are not passive infrastructure. They are prime asymmetric targets. The [vulnerability](https://thecyberexpress.com/firewall-daily/vulnerabilities/ "vulnerability") in Smart Install isn’t new, but the threat remains potent. Critical infrastructure operators need to harden network gear, build detection-first strategies, and elevate device [security](https://thecyberexpress.com/ "security") to boardroom-level concern.
Share this:
- Click to share on LinkedIn (Opens in new window) LinkedIn
- Click to share on Reddit (Opens in new window) Reddit
- Click to share on X (Opens in new window) X
- Click to share on Facebook (Opens in new window) Facebook
- [More](#)
- [Click to email a link to a friend (Opens in new window) Email](mailto:?subject=%5BShared%20Post%5D%20Russia%27s%20FSB-Linked%20Hackers%20Targeting%20Cisco%20Network%20Gear%20Used%20in%20Critical%20Infrastructure&body=https%3A%2F%2Fthecyberexpress.com%2Frussia-targeting-cisco-network-gear%2F&share=email)
- Click to share on WhatsApp (Opens in new window) WhatsApp
_Related_
Tags: Ciscocritical infrastructureCVE-2018-0171Energetic BearStatic Tundra [Previous Post
Europol Says $50k Reward on Qilin Ransomware Group Admins is Fake
](https://thecyberexpress.com/europol-reward-qilin-ransomware-group/)[Next Post
DOM-Based Extension Clickjacking Exposes Millions of Password Manager Users to Credential Theft
](https://thecyberexpress.com/dom%e2%80%91based-extension-clickjacking/)Next Post [](https://thecyberexpress.com/dom%e2%80%91based-extension-clickjacking/)
DOM-Based Extension Clickjacking Exposes Millions of Password Manager Users to Credential Theft
[](#)[](https://cyble.com/request-demo/?utm_source=cyber_express&utm_medium=sidebar)Follow Us On Google News
Latest Cyber News
[](https://thecyberexpress.com/1200-arrested-operation-serengeti-2-0/) Cyber News
African Authorities Arrest 1,200 People, Seize Millions in Massive Cybercrime and Fraud Networks’ Bust
August 22, 2025 [](https://thecyberexpress.com/csrf-flaw-cve-2025-8592/) Firewall Daily
70,000 WordPress Sites Exposed by Inspiro Theme Security Flaw
August 22, 2025 [](https://thecyberexpress.com/cisa-warns-of-ics-vulnerabilities/) Firewall Daily
CISA Warns of Critical ICS Flaws in Siemens, Tigo Energy, and EG4 Equipment
August 22, 2025 [ ](https://thecyberexpress.com/black-hat-usa-2025-ciso-podcast-series-ep-2/)Firewall Daily
Black Hat USA 2025 CISO Podcast Series: Episode 2 Now Live
Categories
Categories Select Category Appointments Budgets Bug Bounty & Rewards Business News Compliance Cyber Essentials Cyber News Cyber Warfare Cybersecurity Awareness Month Dark Web News Data Breach News DDoS Attacks News Deepfake Espionage Features Firewall Daily Gitex2022 Governance Hacker Claims Hacker News Hackers Interview How to Interviews Knowledge Hub Learning & Development Lockbit Ransomware News Main Story Malware News Market Reports Mergers & Aquisitions Partnerships Podcast Policy Updates Press Release Ransomware News Regulations Research Resources Sponsored Content Startups Threat Actors Threat Intelligence Threat Intelligence News Trends Vulnerabilities Vulnerability News What is Whitepapers Workforce
Web Stories
[](https://thecyberexpress.com/web-stories/if-you-do-this-on-telegram-your-bank-account-will-become-zero/)Do This on Telegram, Your Bank Account Will Become Zero [ ](https://thecyberexpress.com/web-stories/ios-18-beta/)If You Install the iOS 18 Beta, Your iPhone Could Be Hacked [ ](https://thecyberexpress.com/web-stories/cricket-world-cup-ticketing-systems/)Cricket World Cup Ticketing Systems Under Cybersecurity [ ](https://thecyberexpress.com/web-stories/nba-finals/)Cyber Threats and Online Ticket Scams During the NBA Finals [ ](https://thecyberexpress.com/web-stories/biometric-data-security-protecting-sensitive-information/)Biometric Data Security: Protecting Sensitive Information
About
The Cyber Express
-----------------
#1 Trending Cybersecurity News and Magazine
The Cyber Express is a handbook for all stakeholders of the internet that provides information security professionals with the latest news, updates and knowledge they need to combat cyber threats.
Contact
For editorial queries: [editor@thecyberexpress.com](mailto:editor@thecyberexpress.com)
For marketing and Sales: [raj@thecyberexpress.com](mailto:raj@thecyberexpress.com)
Quick Links
- About Us
- Contact Us
- Editorial Calendar
- Careers
- The Cyber Express by Cyble Vulnerability Disclosure Policy
- Cyble Trust Portal
Our Address
We’re remote friendly, with office locations around the world:
San Francisco, Atlanta, Rome, Dubai, Mumbai, Bangalore, Hyderabad, Singapore, Jakarta, Sydney, and Melbourne
Headquarters:
The Cyber Express LLC 10080 North Wolfe Road, Suite SW3-200, Cupertino, CA, US 95014
India Office:
Cyber Express Media Network HD-021, 4th Floor, C Wing, Building No.4. Nesco IT Park, WE Highway, Goregaon East, Mumbai, Maharashtra, India – 4000063
© 2025 [The Cyber Express](https://thecyberexpress.com "The Cyber Express") - Cybersecurity News and Magazine.
[](#back-to-top)
Welcome Back!
Login to your account below
Remember Me
[Forgotten Password?](#jeg_forgotform)
Retrieve your password
Please enter your username or email address to reset your password.
[Log In](#jeg_loginform)
Add New Playlist
\- Select Visibility -PublicPrivate
[](#)[](#)No Result View All Result
- [Magazine](https://thecyberexpress.com/cybersecurity-magazine/ "Cybersecurity Magazine")
- Firewall Daily
- Essentials
* Startups
* Budgets
* Research
* Podcast
* Webinar
[](https://facebook.com)[](https://twitter.com)
© 2025 [The Cyber Express](https://thecyberexpress.com "The Cyber Express") - Cybersecurity News and Magazine.
Are you sure want to unlock this post?
Unlock left : 0 Yes No
Are you sure want to cancel subscription?
Yes No \- 00:00 00:00
Queue
Update Required Flash plugin \- 00:00 00:00
Do This on Telegram, Your Bank Account Will Become Zero If You Install the iOS 18 Beta, Your iPhone Could Be Hacked Cricket World Cup Ticketing Systems Under Cybersecurity Cyber Threats and Online Ticket Scams During the NBA Finals Biometric Data Security: Protecting Sensitive Information ![]()