Russian state-sponsored cyber actors appear to be performing worldwide cyber exploitation of enterprise-class and SOHO/residential network infrastructure devices (e.g., router, switch, firewall, Network-based Intrusion Detection System (NIDS) devices). This campaign, particularly the choice of protocols and devices appears to have some overlap with earlier reports detailing the vulnerability CVE-2018-0171, as well as, reports detailing cyber-attacks on network infrastructure utilizing vulnerabilities in smart install (SMI).
This attack was an attempt to exploit vulnerabilities in routers and switches which was intended to advance spying, intellectual property theft and other malicious activity. It is feared that the exploited routers could be used to launch future offensive cyber operations.
Do note that Russian cyber actors do not actually need to leverage zero-day vulnerabilities or install malware to exploit the devices. They are taking advantage of the following older, existing vulnerabilities:
- Devices with legacy unencrypted protocols or unauthenticated services
- Devices that are insufficiently hardened before installation
- Devices that are no longer supported with security patches by manufacturers or vendors such as end-of-life devices
Affected Systems:
- Generic Routing Encapsulation Enabled Devices
- CISCO Smart Install Enabled Devices
- Simple Network Management Protocol Enabled Devices
Proficio Threat Intelligence Recommendations:
- Regularly inspect firewall policies that have Cisco Smart Install (4786 TCP) open to the internet and make sure they are set to only allow the IP ranges that are required for the connection
- Regularly inspect firewall policies that have telnet open to the internet and close the connection
- Mitigate the risks of compromised credentials by utilizing multi-factor authentication and strong password policies for all accounts, with special emphasis on any external-facing interfaces and high-risk environments
- Restrict internet access to the management interface of any network device
- Configure network devices before installing onto a network exposed to the internet. If SMI must be used during installation, disable SMI with the “no vstack” command before placing the device into operation
General Information – Click Here
