UK exposes Russian military intelligence hijacking vulnerable routers for cyber attacks

An NCSC advisory warns that the Russian military intelligence-backed threat group APT28 (aka Fancy Bear, Strontium) has been exploiting vulnerabilities in Cisco routers to facilitate malicious cyber operations. This campaign has been ongoing since at least 2021, allowing the group to maintain persistence and pivot to other targets.

Technical Breakdown

• Threat Actor: APT28 (Sandworm, Fancy Bear, Strontium, FROZENBARENTS, VOOODOOBEAR)
• TTPs:
  • Initial Access: Exploiting known vulnerabilities in public-facing edge devices. Specifically, the NCSC advisory highlights exploitation of CVE-2017-6742 in Cisco IOS XE software.
  • Persistence: Installation of custom malware on compromised routers.
  • Command & Control: Utilizing compromised routers as infrastructure to route further malicious traffic, masking their true origin.
  • Impact: Information collection and establishing a platform for broader cyber attacks.
• Affected Devices: Vulnerable Cisco routers running IOS XE software.

Defense

Prioritize patching of all internet-facing network infrastructure to the latest vendor-provided versions, and implement strong network segmentation and monitoring for unusual traffic patterns on edge devices.

Source: https://www.ncsc.gov.uk/news/uk-exposes-russian-military-intelligence-hijacking-vulnerable-routers-for-cyber-attacks