FSB Center 16 (Berserk Bear/Energetic Bear/Static Tundra) Router Exploitation Campaign

Technical Analysis

The actors conduct proxied, spoofed-source SNMP Set-Requests (T1595.001/T1595.002, T1027) against devices with SNMPv1/v2 exposed and using default or weak community strings, instructing agents to copy device configurations (T1602.001/T1602.002, T1003) to files (e.g., 'config.bkp', 'output.txt') and exfiltrate them via TFTP to actor-controlled VPS or compromised FTP infrastructure (T1583.003, T1090, T1071, T1048). Secondary access vectors include exploitation of Cisco Smart Install (SMI) misuse and known CVEs — CVE-2018-0171 and CVE-2008-4128 (EoL devices only) — for initial access and privilege escalation (T1190, T1068). Extracted configurations frequently contain weakly hashed (Cisco Type 7/Type 0) or plaintext credentials, enabling lateral movement and persistent network access; TTPs substantially overlap with other state actors such as Salt Typhoon. While this campaign targets network infrastructure rather than AI systems directly, organizations running agent frameworks, RAG pipelines, or LLM tool-use behind compromised edge routers/VPN gateways face risk of credential/API key interception, traffic redirection via rogue proxies, and loss of network integrity that underpins secure agent-to-tool and agent-to-model communications — making router hardening directly relevant to protecting agent infrastructure.

Affected Systems

Cisco networking devices with Cisco Smart Install (SMI) enabled; devices running SNMPv1/SNMPv2 with default or weak community strings; end-of-life Cisco devices vulnerable to CVE-2008-4128; devices unpatched against CVE-2018-0171 (Cisco IOS/IOS XE Smart Install); routers/network devices with weak local credential storage (Cisco password hash types 0, 4, 7); internet-facing management interfaces (TFTP/UDP 69, SMI/TCP 4786, SNMP UDP 161/162, SNMPv3 TCP/UDP 10161/10162) lacking access control lists.

Indicators of Compromise

• config.bkp
• output.txt
• SNMP OID 1.3.6.1.4.1.9.9.96.1.1 (Cisco Config Copy)
• SNMP OID 1.3.6.1.4.1.9.9.96.1.1.1.1.5 (Config Copy Server Address)
• TFTP transfers to actor-controlled VPS/FTP infrastructure
• Spoofed-source SNMP Set-Requests

Remediation Steps

1. 1

   Disable Cisco Smart Install

   Disable the Smart Install feature on all Cisco devices to eliminate a known abuse vector for configuration exfiltration and code execution.

2. 2

   Upgrade to SNMPv3

   Deploy SNMPv3 with authPriv and strong encryption; disable SNMPv1/v2. If legacy SNMP is unavoidable, change default community strings and restrict to read-only access.

3. 3

   Harden credentials

   Use strong, unique local device passwords, store using Cisco Type 8 hashing (avoid types 0, 4, 7), and enable centralized authentication with MFA where feasible.

4. 4

   Restrict SNMP OID access

   Implement MIB allow-lists and IDS rules to detect and block SNMP Set-Requests targeting sensitive configuration OIDs.

5. 5

   Restrict management protocol exposure

   Apply ACLs limiting SNMP/TFTP/SMI to management networks; block inbound UDP 69, TCP 4786, UDP 161/162, and TCP/UDP 10161/10162 at the network edge unless mission-critical.

6. 6

   Patch and upgrade devices

   Apply patches for CVE-2018-0171 and replace end-of-life devices affected by CVE-2008-4128; maintain current firmware across all network infrastructure.

7. 7

   Attack surface monitoring

   Use attack surface management tooling (e.g., CISA Cyber Hygiene services, NSA DIB Cybersecurity Services) to identify internet-facing devices with weak configurations.