Nineteen federal agencies across North America, the United Kingdom, Europe, and Australia issued a joint cybersecurity advisory on July 14 warning that Russian state-sponsored threat actors continue exploiting poorly-configured routers in critical infrastructure networks using decade-old Simple Network Management Protocol (SNMP) vulnerabilities, according to the multinational bulletin coordinated by participating nations’ cyber defense organizations. The advisory specifically identifies six Russian groups—”Berserk Bear,” “Crouching Yeti,” “Dragonfly,” “Energetic Bear,” “Ghost Blizzard,” and “Static Tundra”—systematically scanning for routers using insecure SNMPv1 or SNMPv2 protocols with default community strings to steal configuration files containing plaintext credentials and network topology data.
TL;DR: Nineteen global agencies warn Russian state-sponsored groups exploit SNMP router weaknesses to steal configuration files from critical infrastructure; recommend immediate upgrade to SNMPv3 and disabling Cisco Smart Install.
The advisory represents a coordinated response to ongoing attacks targeting communications, energy, financial services, defense industrial bases, healthcare facilities, and government networks where routers remain inadequately protected despite years of documented vulnerabilities. “It might sound simple, but this tactic has been exploited for well over a decade, and is clearly still effective,” said Seva Ioussoufovitch, senior research analyst at Info-Tech Research Group, in comments on the advisory.
How the Attacks Work
Threat actors initiate attacks by sending SNMP requests that scan for weakened devices still running older SNMPv1 or SNMPv2 protocols that accept common or default “community strings” for authentication. These strings function as shared passwords with predictable, publicly-documented defaults that network administrators frequently leave unchanged during initial router deployment.
Using spoofed IP addresses, attackers instruct SNMP agents running on compromised devices to copy their configurations to files—typically named “config.bkp” or “output.txt”—then transfer those files to virtual private servers under the attackers’ control. The configuration files contain plaintext or weakly-encoded credentials, IP addressing schemes, routing tables, and details about an organization’s network architecture.
The agencies confirmed that Russian groups are also exploiting specific Cisco device vulnerabilities, including CVE-2018-0171 (published in 2018) and CVE-2008-4128 (published in 2008), which allow remote, unauthenticated attackers to execute arbitrary code, take unauthorized actions, or cause denial-of-service conditions. Additional attacks exploit Cisco’s Smart Install (SMI) tool when it remains enabled after initial device configuration.
Set-and-Forget Security Culture Persists
The bulletin highlights what Ioussoufovitch described as a “confluence of typical enterprise shortcomings” when operationalizing network device security. Many organizations take a set-it-and-forget-it approach to routers and do not track them with the same rigor applied to endpoints, according to his analysis.
Routers’ critical role in business continuity and disaster recovery increases both their value as targets and the risk associated with prolonged patching windows. Organizational confusion about security ownership further compounds the problem. “Security points to the network team and they’re pointing right back at security,” Ioussoufovitch noted, describing accountability gaps common in enterprise IT departments.
Legacy hardware dependencies present another persistent challenge. Organizations continue operating unsupported devices that the business remains unwilling to replace despite known vulnerabilities. “Network security just doesn’t seem to be receiving the same amount of attention as the usual areas of focus (like endpoints),” Ioussoufovitch said.
Recommended Immediate Actions
The participating agencies issued specific technical recommendations for security teams and network administrators to implement immediately. Organizations should disable SNMPv1 and SNMPv2 entirely, which the bulletin characterizes as “legacy protocols and should no longer be needed on current devices.” In cases where legacy protocol support remains temporarily necessary, administrators should restrict access to read-only permissions and eliminate read-write access.
All network devices should migrate to SNMPv3 configured with authPriv using “the most modern encryption standard,” according to the advisory. SNMPv3 adds strong authentication and data encryption unavailable in previous versions through more securely encoded parameters. “Moving to SNMPv3, which offers stronger authentication and encryption, is a clear, actionable step security teams need to prioritize now,” Ioussoufovitch said.
Additional recommendations include enforcing strong, unique passwords for local accounts on network devices; monitoring for unusual credentials that do not match standard naming conventions in logs or intrusion detection systems; implementing multi-factor authentication on network management interfaces; and enforcing allow lists for management protocols including SNMP.
Enterprises should update network device software to current versions, retire end-of-life devices, and disable Cisco Smart Install on all machines once initial configuration is complete. The advisory noted that Smart Install “introduces serious security issues when it inadvertently remains enabled” beyond the deployment phase. Organizations should also block SNMP traffic and common file transfer protocols at the firewall perimeter.
What This Means for IT Managers
Philippine enterprises and government agencies operating critical infrastructure face identical router security exposures identified in the multinational advisory, particularly in sectors the bulletin specifically named: communications carriers, energy facilities, financial services institutions, healthcare providers, and government offices. The National Telecommunications Commission and DICT-regulated entities managing network infrastructure should treat SNMP protocol upgrades as immediate compliance priorities, not routine maintenance tasks.
The tactical shift to SNMPv3 with authPriv encryption requires no capital expenditure for organizations running current-generation routers but demands dedicated implementation time from network teams. IT managers should audit their enterprise data center infrastructure and branch router inventories this week to identify devices still running SNMPv1 or SNMPv2, document which systems require legacy protocol support, and schedule migration windows. Organizations that previously dismissed router security as a vendor-managed problem must now assign clear ownership—a recurring accountability gap Ioussoufovitch identified affects enterprise IT departments globally, including those in Metro Manila, Cebu, and Davao.
Cisco device operators face compounded risk given the advisory’s specific mention of CVE-2018-0171 and CVE-2008-4128 exploitation in active Russian campaigns. Philippine organizations running Cisco infrastructure should cross-reference their installed base against these documented vulnerabilities and verify that Smart Install remains disabled on all production routers beyond initial deployment phases. The bulletin’s warning that configuration files contain “plaintext or weakly-encoded” credentials underscores why router compromise delivers immediate lateral-movement opportunities across Philippine enterprise networks where many organizations still operate flat network architectures without segmentation.
