The Federal Bureau of Investigation (FBI) has issued a public warning detailing an ongoing campaign by Russian Federal Security Service (FSB) cyber operators, known as Center 16—or by the cybersecurity community as “Berserk Bear” and “Dragonfly”—against legacy networking equipment.
At the heart of this campaign is the exploitation of an unpatched vulnerability, CVE-2018-0171, in Cisco’s Smart Install (SMI) feature.
Exploitation of this flaw allows remote attackers to gain access to the device’s configuration files, and in some instances, to inject malicious modifications that grant persistent unauthorized access.
The vulnerability, first publicly disclosed in 2018, affects Cisco devices running Smart Install without requiring user authentication.
According to the FBI, the actors have capitalized on many network operators’ reliance on end-of-life hardware and outdated protocols like SNMP versions 1 and 2, which lack modern encryption safeguards.
By automatically retrieving and altering device configurations, the FSB operators can not only map internal network topologies but also maintain covert footholds for future operations.
Critical Infrastructure Impact
Over the past year, the FBI’s cybersecurity partners have observed these Russian operators targeting thousands of networking devices associated with U.S. organizations across multiple critical infrastructure sectors.
Industrial control systems (ICS) and operational technology (OT) environments appear to be of particular interest, as reconnaissance of protocols and applications commonly used in these contexts has been noted in several compromised networks.
Such activity suggests preparation for potential disruption or sabotage of essential services, ranging from energy grids to water treatment facilities.
The group’s prior toolset includes the 2015 malware “SYNful Knock,” a custom payload designed to embed itself into Cisco devices’ firmware and evade detection.
The current campaign extends this modus operandi by focusing on mass-exploitation of unpatched legacy features, thereby lowering the technical barrier to widespread compromise.
The FBI warns that organizations may not notice subtle changes to configuration files until a more damaging second stage of the attack is launched.
Guidance and Next Steps
In light of these developments, the FBI and its law enforcement partners have reiterated mitigation guidance originally published in a 2018 Technical Alert and augmented by a recent Joint Advisory on primary mitigations for OT environments dated May 6, 2025. Key recommendations include:
- Patch Management: Immediately apply Cisco’s software updates that remove or secure the Smart Install feature. Where updates cannot be deployed, disable SMI entirely and restrict management access to trusted administrative networks.
- Protocol Hardening: Phase out unencrypted protocols such as SNMP v1 and v2. Upgrade configurations to SNMP v3, which offers encryption and authentication.
- Configuration Monitoring: Implement continuous monitoring of configuration files and firmware integrity checks to detect unauthorized changes.
- Network Segmentation: Isolate OT and ICS networks from corporate IT environments and the Internet, enforcing strict access controls and multi-factor authentication for all administrative sessions.
- Incident Reporting: If organizations suspect compromise, they should immediately contact their local FBI field office or file a report with the FBI’s Internet Crime Complaint Center (IC3). Detailed logs of any configuration changes, observed malware artifacts, and network reconnaissance data should be provided when filing a report.
Cisco Talos has also published an in-depth analysis of this threat actor under the name “Static Tundra” as of August 20, 2025, offering indicators of compromise (IOCs) and detection strategies tailored to affected devices.
Security teams are urged to review these resources alongside the FBI guidance to strengthen their networks against future intrusions.
The convergence of aging network infrastructure, insufficient patching practices, and targeted state-sponsored activity underscores the critical importance of rigorous cybersecurity hygiene.
As FSB Center 16 continues to refine its toolkit and broaden its campaigns, proactive defense measures remain the most effective means to safeguard critical systems from stealthy adversaries.
Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates
 has issued a public warning detailing an ongoing campaign by Russian Federal Security Service (FSB) cyber operators.){kind=link}