All Articles

Your routers do not need a zero-day to be compromised. A default SNMP community string is enough.

That is the core finding of AA26-194A, released July 13 by NSA, CISA, FBI and DoD Cyber Crime Center together with agencies from Australia, Canada, New Zealand, the UK, Czech Republic, Denmark, Estonia, Finland, France, Italy, Poland, and Sweden. It documents a decade-plus campaign by Russian FSB Center 16, the group the industry tracks as Berserk Bear, Energetic Bear, Dragonfly, Ghost Blizzard, and Static Tundra.

The Attack Chain, Step by Step

1. Scan. The actors scan internet IP ranges (via proxies) for active SNMP agents that accept common or default community strings.
2. Command. They send SNMP Set-Requests from spoofed IP addresses containing OIDs that instruct the device to copy its configuration to a file, often named "config.bkp" or "output.txt".
3. Exfiltrate. The config file is transferred over TFTP to an actor-controlled VPS or a compromised FTP server.
4. Reuse. Credentials and topology from the stolen config enable deeper access later.

The router does exactly what SNMP tells it to do. That is the whole trick.

The fallback: known CVEs

When scanning fails, the group exploits known flaws: CVE-2018-0171 (Cisco Smart Install, targeted since November 2021 per the FBI) and CVE-2008-4128, plus web management portals. CISA notes these TTPs overlap with other actors, including Salt Typhoon, so the mitigations pay off beyond this one group.

Timeline

What This Means for Security Teams

Network devices are the blind spot. They rarely run EDR, their logs rarely reach the SIEM, and their configs hold credentials and topology. This campaign lives entirely in that gap.

"Poorly configured" beats "vulnerable." The primary vector here is a 1990s-era default setting, not a CVE. Patch management alone does not close it.

A stolen config is persistent access without persistence. Nothing is implanted on the device, so there is nothing for endpoint tooling to find. Detection has to happen at the network layer.

The 8 Fixes, Straight From the Advisory

1. Disable Cisco Smart Install on all devices.
2. Move to SNMPv3 with authPriv; disable SNMPv1 and v2. If v1/v2 must stay, use non-default, read-only community strings.
3. Use type 8 password hashing on Cisco devices. Avoid types 0, 4, and 7: they are insecure or plaintext.
4. Alert on local-account logins. Local accounts are for emergencies; centralize authentication with MFA.
5. Write IDS rules for inbound SNMP Set-Requests carrying sensitive OIDs, and build a MIB allow-list. Watch 1.3.6.1.4.1.9.9.96.1.1 (Cisco Config Copy) and 1.3.6.1.4.1.9.9.96.1.1.1.1.5 (Config Copy Server Address: the value shows where your config is being sent).
6. Restrict management protocols to an out-of-band network using ACLs.
7. Deny at edge firewalls unless mission critical: UDP 69 (TFTP), TCP 4786 (Smart Install), UDP 161/162 (SNMP), TCP/UDP 10161/10162 (SNMPv3).
8. Patch firmware and replace end-of-life devices; use attack surface management to find exposed systems.

If you do one thing today: run an external scan of your public ranges for UDP 161 and TCP 4786. If either answers, you are on this campaign's target list.

30-Day Checklist

• Week 1: External scan for SNMP, Smart Install, and TFTP exposure. Inventory SNMP versions and community strings in use.
• Week 2: Disable Smart Install. Migrate to SNMPv3 authPriv. Rotate any credentials embedded in device configs.
• Week 3: Edge firewall rules for the six ports above. ACLs restricting management traffic to out-of-band.
• Week 4: Deploy IDS rules for the Config Copy OIDs. Tabletop the scenario: "our router config is on an attacker's server."

Related on CISOPlatform

• CISA's GitHub Credential Leak Postmortem: 7 Lessons Every CISO Must Act On Now
• CISO fireside chat: Managing a Dynamic Attack Surface, with Rick Doten (VP Information Security, Centene)
• Fireside chat: Revolutionizing Incident Response and Building True Cyber Resilience, with Dr. Erdal Ozkaya

Join the Discussion

Three questions for practitioners. Answer in the comments:

• When did your team last audit SNMP versions and community strings on edge devices, and what did you find?
• Do your router and switch logs actually reach your SIEM, or do network devices sit outside your detection pipeline?
• Have you ever tabletopped a stolen-config scenario where the attacker needs no persistence on the device?

Sources: CISA joint advisory AA26-194A, July 13, 2026; BleepingComputer, July 13, 2026.