Russian campaign targets legacy Cisco devices via Smart Install flaw

A Russian state-sponsored cyber espionage campaign has persisted for more than a decade, exploiting a seven-year-old Cisco vulnerability to compromise thousands of network devices tied to critical infrastructure worldwide. The operation, run by a group associated with the FSB’s Center 16 and tracked under several names including Static Tundra, Berserk Bear, Dragonfly and Blue Kraken, targets unpatched or end-of-life Cisco devices that still run the Smart Install feature. Researchers say the attackers have amassed configuration data from affected devices to enable long-term access, reconnaissance, and potential disruption of future operations.

The flaw in question, CVE20180171, resides in Cisco’s Smart Install mechanism and allows remote code execution or a device reload if exploit paths are left open. Cisco addressed the vulnerability in 2018, but many devices remain unpatched or no longer receive security updates due to their age. The campaign’s methods are notable for their persistence and automation: attackers systematically identify devices via public-facing internet scanning services, breach them, and pull configurations that often contain administrator credentials and...