US and UK Alert Public of Russian Exploitation of Cisco Vulnerabilities

The United States and the United Kingdom have warned that Russian military hackers are exploiting a vulnerability in Cisco routers. In a joint advisory published on April 18, 2023, the UK’s National Cyber Security Centre (NCSC), CISA, the NSA and the FBI said the group known as APT28 had used the flaw to get into routers worldwide, including some belonging to U.S. government agencies and around 250 Ukrainian victims.

According to the advisory, APT28 exploited CVE-2017-6742, a stack overflow in the Simple Network Management Protocol (SNMP) code of Cisco IOS. Cisco patched it in June 2017. The attackers used weak or default SNMP community strings to probe devices, then deployed malware the NCSC calls “Jaguar Tooth,” which collects device information and gives unauthenticated access to the router.

The attacks work because many organizations still run Cisco equipment without the latest patches, and some leave SNMP open with default settings. Once inside a router, attackers can watch and redirect network traffic.

The US and UK authorities are urging organizations to patch their Cisco devices now. They also recommend disabling SNMP v1 and v2c, restricting SNMP access, and switching to SNMPv3 and SSH for management.

Individuals and organizations are also advised to monitor their systems for any signs of unauthorized access or unusual activity. This includes looking for indicators of compromise (IOCs), which can help identify whether a system has been compromised.

Old, unpatched network gear remains an easy way in for state hackers. Governments and businesses should keep checking their routers and switches, not just their servers and laptops.

Update software, use strong passwords and turn on two-factor authentication wherever you can. Stay informed about new threats and vulnerabilities, and report suspicious activity to the authorities. Basic hygiene stops a surprising number of attacks.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.