FBI warns of Russian hacker attacks on US critical infrastructure
Kyiv • UNN
The FBI and Cisco reported that Russian hackers exploited a vulnerability in old Cisco software to attack thousands of network devices. Hackers collected configuration files and modified them for long-term access to critical infrastructure.
Hackers linked to some of Russia's most notorious cyber-espionage units have been exploiting a vulnerability in old Cisco software over the past year to attack thousands of network devices connected to critical infrastructure, the FBI and Cisco said on Wednesday, UNN reports with reference to Reuters.
Details
"Hackers working for Center 16 of Russia's Federal Security Service (FSB) are massively extracting "device configuration information that can later be used as needed in accordance with the current strategic goals and interests of the Russian government," Cisco Talos researchers Sarah McBroom and Brandon White wrote in a threat advisory published on the company's blog.
In a separate bulletin, the FBI said that over the past year, hackers have been found to be collecting configuration files "for thousands of network devices associated with US organizations in critical infrastructure sectors."
Russian hackers stole secret documents from US courts for years15.08.25, 02:11 • 5679 views
In some cases, configuration files are reportedly modified to provide hackers with long-term access, which they use to scout targeted networks, especially industrial control systems.
The Russian embassy in Washington did not respond to a request for comment. Moscow denies conducting cyber-espionage operations.
According to a separate threat bulletin published Wednesday by Cisco Talos, Cisco's threat research unit, hackers are exploiting a seven-year-old vulnerability in Cisco IOS software, attacking unpatched and outdated network devices.
Cisco Talos researchers note that other state-sponsored hackers are likely conducting similar hacking operations targeting these devices.
Organizations in telecommunications, higher education, and manufacturing in North America, Asia, Africa, and Europe were most frequently attacked, "victims were chosen based on their strategic interest to the Russian government," researchers said.
According to researchers, the hacking unit associated with this activity has been operating for at least 10 years and is likely a subgroup of FSB Center 16. In March 2022, the US Department of Justice accused four Russian citizens who were part of this group of illegally attacking the global energy sector between 2012 and 2018.