US and Allies Recommend Securing Network Devices Against Russian APT Groups
Call to protect critical infrastructure from Russian cyber threats.
1Target of Russian APT Groups
The US and allies have warned that Russian state-sponsored APT groups are targeting poorly secured network devices, especially routers, to infiltrate critical infrastructure. These groups focus on organizations in communications, defense, energy, finance, government, and healthcare sectors.
2Methods of FSB Center 16
Russian FSB Center 16 cyber actors exploit poorly configured network devices by scanning for SNMP services. They use spoofed requests to steal device configurations and transfer them to attacker-controlled servers. Known Cisco vulnerabilities are also exploited.
3SNMP and Cisco Vulnerabilities
APT groups discover weakly configured devices through SNMP scanning. They exploit known vulnerabilities in Cisco Smart Install and web portals. These techniques overlap with those used by other state-sponsored groups.
4Critical Sectors at Risk
Energy, finance, and healthcare sectors are prime targets for Russian APT groups. These groups can cause widespread damage by gaining access to infrastructure. Organizations must enhance their security measures.
5Recommended Security Measures
To strengthen router security, disable Cisco Smart Install, use SNMPv3, and enforce strong passwords. Monitor SNMP activity, block unnecessary ports, and ensure devices are kept up to date.
6Global Collaboration for Security
The US and allies propose a global defense strategy against Russian APT groups. These measures protect not only against Russian threats but also against other state-sponsored groups. Immediate steps are needed to safeguard critical infrastructure.
Original article: Security Affairs — Rus APT Gruplarına Karşı Ağ Cihazlarını Güçlendirme Önerileri