APT28 exploits unpatched Cisco routers for network access
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Russia's APT28 actively exploits CVE-2017-6742 in poorly maintained Cisco routers to deploy Jaguar Tooth malware and gain persistent network access.
UK and US government agencies (NCSC, NSA, CISA, FBI) have issued a joint advisory warning of active exploitation by APT28, a threat group attributed to Russia's GRU military intelligence service. Since 2021, APT28 has targeted Cisco routers globally by exploiting CVE-2017-6742, a known vulnerability affecting poorly configured and inadequately maintained devices. The campaign has affected European organizations, US government institutions, and approximately 250 Ukrainian targets. After initial reconnaissance, APT28 deploys Jaguar Tooth malware to enable unauthenticated access to compromised routers, establishing persistent network footholds.
Defenders should prioritize applying Cisco's security update addressing CVE-2017-6742 to all affected routers. The advisory recommends additional mitigations including ensuring strong authentication credentials, disabling unnecessary services, implementing network segmentation, and monitoring for unauthorized access attempts. Organizations should treat router compromise as a serious threat requiring immediate remediation given APT28's confirmed interest in this attack vector and the persistence Jaguar Tooth provides once deployed.
Mentioned in this report
Detection guidance
Inbound SNMP Traffic From Non-Private Source to Internal Device
Detects SNMP (UDP/TCP 161) traffic from public IP space to internal devices. This is the exposure that CVE-2017-6742 exploitation against Cisco routers relies on. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Inbound SNMP Traffic From Non-Private Source to Internal Device
id: 0aa7e79c-7a56-5180-b392-eb3ff2ae552b
status: experimental
description: Detects SNMP (port 161) connections from public IP space to internal
hosts, such as network devices. Exploitation of the Cisco SNMP flaw CVE-2017-6742
by APT28 requires reachability of the SNMP service. Tune by excluding known external
monitoring providers.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: firewall
detection:
selection:
dst_port: 161
filter_private_src:
src_ip|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 127.0.0.0/8
- 169.254.0.0/16
condition: selection and not filter_private_src
falsepositives:
- Third-party managed-service providers polling SNMP over the internet
- Internet-wide scanners hitting exposed SNMP, which is still worth review
level: medium
author: Vorant
references:
- https://www.ncsc.gov.uk/news/uk-and-us-issue-warning-about-apt28-actors-exploiting-poorly-maintained-cisco-routers
Outbound TFTP Traffic to Non-Private Destination
Detects TFTP (port 69) traffic to public IP space. Compromised network devices can use TFTP to automatically push configuration or collected data out. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Outbound TFTP Traffic to Non-Private Destination
id: 3a8dc5cc-78f1-524e-a374-4388211fbad4
status: experimental
description: Detects TFTP (port 69) connections to public IP space. TFTP is unauthenticated
and plaintext and is rarely sent across the internet legitimately. Compromised routers
can use it for automated exfiltration of configuration and device data.
tags:
- attack.exfiltration
- attack.t1020
logsource:
category: firewall
detection:
selection:
dst_port: 69
filter_private_dst:
dst_ip|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 127.0.0.0/8
- 169.254.0.0/16
condition: selection and not filter_private_dst
falsepositives:
- Legacy provisioning or firmware workflows that use an external TFTP server
level: medium
author: Vorant
references:
- https://www.ncsc.gov.uk/news/uk-and-us-issue-warning-about-apt28-actors-exploiting-poorly-maintained-cisco-routers
Cisco Device SNMP Authentication Failure Messages
Detects Cisco IOS syslog SNMP authentication failure messages. A burst of these can indicate community-string guessing or exploit attempts against the SNMP service. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cisco Device SNMP Authentication Failure Messages id: 1f862002-7369-524b-ad88-0cf28e70761b status: experimental description: Detects Cisco IOS SNMP authentication failure syslog events (SNMP-3-AUTHFAIL). Repeated events from external or unexpected sources suggest community-string guessing or exploitation attempts against SNMP, as in CVE-2017-6742 abuse. Alert on volume or on unexpected source addresses in the SIEM. tags: - attack.initial-access - attack.t1190 logsource: product: cisco service: syslog detection: keywords: - SNMP-3-AUTHFAIL condition: keywords falsepositives: - Monitoring systems configured with a wrong community string - Decommissioned NMS hosts still polling the device level: low author: Vorant references: - https://www.ncsc.gov.uk/news/uk-and-us-issue-warning-about-apt28-actors-exploiting-poorly-maintained-cisco-routers
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ncsc.gov.uk/news/uk-and-us-issue-warning-about-apt28-actors-exploiting-poorly-maintained-cisco-routers
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs