Breaches and incidentsBriefChecked against a primary source
Joint advisory AA26-194A: FSB Center 16 targeting routers via SNMP and Cisco Smart Install
NSA, CISA, FBI, DC3 and 15 allied agencies attribute router targeting across communications, DIB, energy, finance, government and healthcare to Russian FSB...
- Disclosed
What happened
- NSA, CISA, FBI, DC3 and 15 allied agencies attribute router targeting across communications, DIB, energy, finance, government and healthcare to Russian FSB Center 16 (industry names include Berserk Bear, Static Tundra, Ghost Blizzard).
- Technique: CVE-2018-0171 (Smart Install) and CVE-2008-4128 (EOL Cisco); SNMP Set-Requests with default community strings that copy configs out over TFTP; weak Type 7 / Type 0 passwords.
Live scores
Live scores
CVE-2008-4128- EPSS
- 0.339
likely to be attacked soon - VEDAS
- 0.977
strong exploit evidence - On CISA KEV
- Yes, since 2026-07-13
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.
Live scores
CVE-2018-0171- EPSS
- 0.995
very likely to be attacked soon - VEDAS
- 0.986
strong exploit evidence - On CISA KEV
- Yes, since 2021-11-03
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Sources
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.