State-sponsored Threat Actor Exploits SNMP Vulnerability in Cisco Routers

The UK National Cyber Security Centre (NCSC), the US National Security Agency (NSA), US Cybersecurity and Infrastructure Security Agency (CISA) and US Federal Bureau of Investigation (FBI) have released a joint advisory describing how state-sponsored threat actors (commonly tracked as APT28) successfully exploited Cisco routers during a 2021 campaign using a known Simple Network Management Protocol (SNMP) vulnerability (CVE-2017-6742).

CVE-2017-6742 was first disclosed in a Cisco security advisory in June 2017 and relates to a buffer overflow condition in the SNMP subsystem. Successful exploitation could allow an authenticated, remote attacker to execute arbitrary code and obtain full control of the affected system or cause the affected system to reload.

In the 2021 campaign detailed by the NCSC, threat actors exploited CVE-2017-6742 to perform reconnaissance, enumerate router interfaces and deploy custom malware known as "Jaguar Tooth", as detailed in the NCSC’s Jaguar Tooth malware analysis report. This malware obtains further device information which is then exfiltrated over trivial file transfer protocol (TFTP) and enables unauthenticated access via a backdoor.

The NCSC have attributed the campaign to APT28, whom they assess as "almost certainly the Russian General Staff Main Intelligence Directorate (GRU) 85th special Service Centre (GTsSS) Military Intelligence Unit 26165." This nation-state group are known to be highly skilled and have previously targeted organsiations throughout Europe and the US.