PRC state-sponsored actors exploit network device CVEs widely
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Chinese state-sponsored cyber actors exploit known vulnerabilities in network devices to compromise telecommunications providers and route traffic to attacker infrastructure.
This joint advisory from NSA, CISA, and FBI describes how People's Republic of China state-sponsored cyber actors have systematically exploited publicly known vulnerabilities in network devices since 2020 to establish a broad infrastructure for compromising targets worldwide. The actors target telecommunications companies and network service providers, using SOHO routers, NAS devices, and VPN gateways as access points and obfuscation nodes. They employ publicly available tools like RouterSploit and RouterScan for reconnaissance, then leverage CVEs to gain initial access before pivoting to critical network infrastructure.
Once inside, the actors identify and compromise RADIUS servers to extract credentials, then use those credentials to access network devices like Cisco and Juniper routers. They execute configuration commands to establish tunnels, enable port mirroring, and exfiltrate traffic to actor-controlled infrastructure while destroying log evidence. The advisory identifies 17 specific CVEs affecting Cisco, Citrix, DrayTik, D-Link, Fortinet, MikroTik, Netgear, Pulse, QNAP, and Zyxel devices as the most frequently exploited since 2020. The threat is ongoing and active; defenders must prioritize patching these devices, implementing MFA, segmenting networks, and disabling unnecessary services.
Mentioned in this report
Detection guidance
Cisco Device Port Mirroring or Tunnel Configuration via Logged CLI Command
Detects logged Cisco IOS config commands that set up SPAN/ERSPAN port mirroring or GRE tunnels, as used to duplicate and exfiltrate traffic to external infrastructure. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cisco Device Port Mirroring or Tunnel Configuration via Logged CLI Command description: Detects Cisco IOS configuration commands (CFGLOG_LOGGEDCMD) that create SPAN/ERSPAN monitor sessions or GRE tunnels. State-sponsored actors with stolen network-device credentials used these to mirror traffic and send it to actor-controlled hosts. Requires command logging (archive log config logging) to be enabled. tags: - attack.exfiltration - attack.t1020.001 - attack.command-and-control - attack.t1572 logsource: product: cisco service: syslog detection: selection_cfglog: - CFGLOG_LOGGEDCMD selection_cmd: - monitor session - erspan - tunnel mode gre - tunnel destination condition: selection_cfglog and selection_cmd falsepositives: - Network engineers legitimately configuring SPAN sessions for IDS/packet capture or GRE tunnels during approved change windows level: medium id: bf5187be-4bdc-5e01-b116-ab438189f886 status: experimental author: Vorant references: - https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-158a
Cisco Device Logging Disabled or Cleared via Logged CLI Command
Detects logged Cisco IOS config commands that disable logging or clear the log buffer, consistent with actors removing evidence after reconfiguring network devices. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cisco Device Logging Disabled or Cleared via Logged CLI Command description: Detects Cisco IOS commands logged via CFGLOG_LOGGEDCMD that disable logging destinations or clear the logging buffer. Actors who compromised network devices through stolen RADIUS-derived credentials cleared logs to hide tunnel and port-mirroring changes. tags: - attack.stealth - attack.defense-impairment - attack.t1070 - attack.t1599 logsource: product: cisco service: syslog detection: selection_cfglog: - CFGLOG_LOGGEDCMD selection_cmd: - no logging - clear logging condition: selection_cfglog and selection_cmd falsepositives: - Administrators resetting the log buffer or changing syslog hosts during troubleshooting or device decommissioning level: medium id: 395db1a6-f215-5550-b7bb-31292e20ff4c status: experimental author: Vorant references: - https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-158a
Linux Execution of RouterSploit Router Exploitation Framework
Detects execution of the RouterSploit framework (rsf.py), a publicly available tool used for reconnaissance and exploitation of network device CVEs. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Linux Execution of RouterSploit Router Exploitation Framework
description: Detects process creation with RouterSploit entry points (rsf.py or routersploit
module). The advisory describes actors using RouterSploit to scan and exploit SOHO
routers, NAS devices and VPN gateways.
tags:
- attack.reconnaissance
- attack.t1595.002
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection_script:
CommandLine|contains:
- rsf.py
- routersploit
selection_interp:
Image|contains: python
selection_direct:
Image|endswith: /rsf.py
condition: (selection_script and selection_interp) or selection_direct
falsepositives:
- Authorized penetration testers or red teams running RouterSploit against in-scope
devices
- Security researchers using RouterSploit in lab hosts
level: medium
id: 8c60fb56-0583-5442-af0a-371f8ff4572a
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-158a
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-158a
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs