Key points
- Russian FSB Center 16 hackers exploited a seven-year-old Cisco IOS vulnerability.
- Thousands of networking devices in critical infrastructure were targeted globally.
- Hackers collected configuration information for long-term access and reconnaissance.
- Telecommunications, higher education, and manufacturing sectors were most affected.
The FBI and Cisco have issued a joint warning about a significant cyber espionage campaign targeting critical infrastructure worldwide. Hackers affiliated with Russia’s FSB Center 16, a known cyber espionage unit, have been exploiting a vulnerability in older Cisco IOS software for at least the past year.
This vulnerability, present in unpatched and end-of-life devices, allows hackers to gain unauthorized access and exfiltrate sensitive data.
The attackers are systematically collecting configuration information from thousands of networking devices belonging to U.S. entities and organizations across various critical infrastructure sectors. This data collection is not limited to the United States; organizations in North America, Asia, Africa, and Europe, particularly in telecommunications, higher education, and manufacturing, have been targeted. The selection of victims appears strategically driven by the Russian government’s interests.
In some instances, hackers modify configuration files to maintain persistent access to compromised networks. This long-term access facilitates reconnaissance activities, focusing particularly on industrial control systems, which are vital components of many critical infrastructure systems.
The information gathered is believed to be used to support future attacks and strategic goals of the Russian government. Cisco Talos researchers have described the operation as a mass extraction of device configuration information.
The Russian embassy in Washington has not responded to requests for comment. The Russian government continues to deny any involvement in cyber espionage activities.
While FSB Center 16 is the primary actor identified, Cisco researchers suggest other state-sponsored groups likely engage in similar attacks. The identified hacking unit has been active for at least a decade, underscoring the long-term nature and sophistication of this cyber threat.
