U.S. and U.K. Warn of Russian Hackers Exploiting Cisco Router Flaws for Espionage

U.K. and U.S. cybersecurity and intelligence organizations have warned of Russian nation-state actors exploiting now-patched flaws in networking gear from Cisco to perform reconnaissance and deploy malware from targets.

The intrusions, for every the authorities, took location in 2021 and focused a tiny variety of entities in Europe, U.S. federal government institutions, and about 250 Ukrainian victims.

The exercise has been attributed to a danger actor tracked as APT28, which is also known as Fancy Bear, Forest Blizzard (formerly Strontium), FROZENLAKE, and Sofacy, and is affiliated with the Russian Typical Team Primary Intelligence Directorate (GRU).

“APT28 has been recognized to access vulnerable routers by using default and weak SNMP neighborhood strings, and by exploiting CVE-2017-6742,” the National Cyber Security Centre (NCSC) reported.

CVE-2017-6742 (CVSS score: 8.8) is element of a set of distant code execution flaws that stem from a buffer overflow situation in the Straightforward Network Management Protocol (SNMP) subsystem in Cisco IOS and IOS XE Software program.

In the attacks observed by the companies, the danger actor weaponized the vulnerability to deploy a non-persistent malware dubbed Jaguar Tooth on Cisco routers which is capable of gathering machine information and enabling unauthenticated backdoor entry.

When the issues had been patched in June 2017, they have given that occur under general public exploitation as of January 11, 2018, underscoring the want for robust patch management practices to limit the attack area.

Moreover updating to the hottest firmware to mitigate prospective threats, the business is also recommending that people swap from SNMP to NETCONF or RESTCONF for network management.

Cisco Talos, in a coordinated advisory, reported the attacks are component of a broader campaign in opposition to aging networking appliances and software from a wide range of suppliers to “progress espionage targets or pre-situation for future harmful exercise.”

Impending WEBINARMaster the Artwork of Dark Web Intelligence Collecting

Understand the art of extracting risk intelligence from the dark web – Be part of this expert-led webinar!

Help you save My Seat!

This includes the set up of destructive program into an infrastructure unit, makes an attempt to surveil network targeted traffic, and attacks mounted by “adversaries with preexisting obtain to internal environments focusing on TACACS+/RADIUS servers to get hold of credentials.”

The alert will come months immediately after the U.S. government sounded the alarm about China-centered point out-sponsored cyber actors leveraging network vulnerabilities to exploit community and non-public sector companies considering the fact that at the very least 2020.

Then earlier this calendar year, Google-owned Mandiant highlighted endeavours carried out by Chinese state-sponsored danger actors to deploy bespoke malware on susceptible Fortinet and SonicWall products.

Uncovered this report interesting? Adhere to us on Twitter  and LinkedIn to go through more exclusive written content we put up.

Some components of this post are sourced from:
thehackernews.com