Russian state cyber group Static Tundra exploiting Cisco devices, FBI warns

The FBI and Cisco Talos warn that the Russian FSB-linked group Static Tundra is actively exploiting CVE-2018-0171 in unpatched and end-of-life Cisco Smart Install devices to harvest device configuration files, establish long-term persistence (including via the SYNful Knock implant), and pivot into victim networks across telecommunications, higher education, manufacturing and critical infrastructure worldwide; stakeholders are urged to patch, disable Smart Install, or seek assistance.