# APT28 exploits unpatched Cisco routers for network access

Published: 2023-04-18 · Severity: high · Sectors: government-national, defense, energy, financial-services
Canonical: https://vorant.io/reports/3aab26af-83d8-53a2-9c01-3c68a5ab3377/apt28-exploits-unpatched-cisco-routers-for-network-access

> Russia's APT28 actively exploits CVE-2017-6742 in poorly maintained Cisco routers to deploy Jaguar Tooth malware and gain persistent network access.

UK and US government agencies (NCSC, NSA, CISA, FBI) have issued a joint advisory warning of active exploitation by APT28, a threat group attributed to Russia's GRU military intelligence service. Since 2021, APT28 has targeted Cisco routers globally by exploiting CVE-2017-6742, a known vulnerability affecting poorly configured and inadequately maintained devices. The campaign has affected European organizations, US government institutions, and approximately 250 Ukrainian targets. After initial reconnaissance, APT28 deploys Jaguar Tooth malware to enable unauthenticated access to compromised routers, establishing persistent network footholds.

Defenders should prioritize applying Cisco's security update addressing CVE-2017-6742 to all affected routers. The advisory recommends additional mitigations including ensuring strong authentication credentials, disabling unnecessary services, implementing network segmentation, and monitoring for unauthorized access attempts. Organizations should treat router compromise as a serious threat requiring immediate remediation given APT28's confirmed interest in this attack vector and the persistence Jaguar Tooth provides once deployed.

## Mentioned in this report

- Vulnerabilities: CVE-2017-6742 (KEV)
- Threat actors: APT28
- Malware: Jaguar Tooth

## Detection guidance (public sample)

### Inbound SNMP Traffic From Non-Private Source to Internal Device

ATT&CK: T1190

Detects SNMP (UDP/TCP 161) traffic from public IP space to internal devices. This is the exposure that CVE-2017-6742 exploitation against Cisco routers relies on. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Inbound SNMP Traffic From Non-Private Source to Internal Device
id: 0aa7e79c-7a56-5180-b392-eb3ff2ae552b
status: experimental
description: Detects SNMP (port 161) connections from public IP space to internal
  hosts, such as network devices. Exploitation of the Cisco SNMP flaw CVE-2017-6742
  by APT28 requires reachability of the SNMP service. Tune by excluding known external
  monitoring providers.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: firewall
detection:
  selection:
    dst_port: 161
  filter_private_src:
    src_ip|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
    - 127.0.0.0/8
    - 169.254.0.0/16
  condition: selection and not filter_private_src
falsepositives:
- Third-party managed-service providers polling SNMP over the internet
- Internet-wide scanners hitting exposed SNMP, which is still worth review
level: medium
author: Vorant
references:
- https://www.ncsc.gov.uk/news/uk-and-us-issue-warning-about-apt28-actors-exploiting-poorly-maintained-cisco-routers
```

### Outbound TFTP Traffic to Non-Private Destination

ATT&CK: T1020

Detects TFTP (port 69) traffic to public IP space. Compromised network devices can use TFTP to automatically push configuration or collected data out. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Outbound TFTP Traffic to Non-Private Destination
id: 3a8dc5cc-78f1-524e-a374-4388211fbad4
status: experimental
description: Detects TFTP (port 69) connections to public IP space. TFTP is unauthenticated
  and plaintext and is rarely sent across the internet legitimately. Compromised routers
  can use it for automated exfiltration of configuration and device data.
tags:
- attack.exfiltration
- attack.t1020
logsource:
  category: firewall
detection:
  selection:
    dst_port: 69
  filter_private_dst:
    dst_ip|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
    - 127.0.0.0/8
    - 169.254.0.0/16
  condition: selection and not filter_private_dst
falsepositives:
- Legacy provisioning or firmware workflows that use an external TFTP server
level: medium
author: Vorant
references:
- https://www.ncsc.gov.uk/news/uk-and-us-issue-warning-about-apt28-actors-exploiting-poorly-maintained-cisco-routers
```

### Cisco Device SNMP Authentication Failure Messages

ATT&CK: T1190

Detects Cisco IOS syslog SNMP authentication failure messages. A burst of these can indicate community-string guessing or exploit attempts against the SNMP service. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Cisco Device SNMP Authentication Failure Messages
id: 1f862002-7369-524b-ad88-0cf28e70761b
status: experimental
description: Detects Cisco IOS SNMP authentication failure syslog events (SNMP-3-AUTHFAIL).
  Repeated events from external or unexpected sources suggest community-string guessing
  or exploitation attempts against SNMP, as in CVE-2017-6742 abuse. Alert on volume
  or on unexpected source addresses in the SIEM.
tags:
- attack.initial-access
- attack.t1190
logsource:
  product: cisco
  service: syslog
detection:
  keywords:
  - SNMP-3-AUTHFAIL
  condition: keywords
falsepositives:
- Monitoring systems configured with a wrong community string
- Decommissioned NMS hosts still polling the device
level: low
author: Vorant
references:
- https://www.ncsc.gov.uk/news/uk-and-us-issue-warning-about-apt28-actors-exploiting-poorly-maintained-cisco-routers
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ncsc.gov.uk/news/uk-and-us-issue-warning-about-apt28-actors-exploiting-poorly-maintained-cisco-routers

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/3aab26af-83d8-53a2-9c01-3c68a5ab3377/apt28-exploits-unpatched-cisco-routers-for-network-access.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup