[1]The Hill reports :

> Russian state-sponsored hackers have targeted thousands of networking devices associated with U.S. critical infrastructure sectors over the past year, [2]the FBI warned Wednesday . The cyber actors are associated with the Russian Federal Security Service's (FSB) Center 16 and have taken aim at a vulnerability in certain Cisco devices, according to an agency public service announcement.

>

> In some cases, hackers have been able to modify configuration files to enable unauthorized access, which they have used to conduct reconnaissance on networks. This has "revealed their interest in protocols and applications commonly associated with industrial control systems," the FBI said.

>

> Cisco's threat intelligence research arm, Talos, explained in a separate advisory that a subcluster of this group, which it has named "Static Tundra," is targeting a seven-year-old vulnerability in the company's Smart Install feature. The firm has offered a patch for the vulnerability, but it remains a problem in unpatched and end-of-life network devices, it warned.

"Once they establish initial access to a network device, Static Tundra will pivot further into the target environment, compromising additional network devices and establishing channels for long-term persistence and information gathering," warns [3]the Talos blog . "This is demonstrated by the group's ability to maintain access in target environments for multiple years without being detected."

In [4]a statement emailed to The Register , a Cisco spokesperson "said the company is aware of ongoing exploitation targeting this flaw."

> "We strongly urge customers to immediately upgrade to fixed software versions as outlined in [5]the security advisory and follow our published security best practices," the spokesperson said, directing customers to the FBI's announcement and Cisco Talos blog for additional details.

>

> The ongoing campaign targets telecommunications, higher education, and manufacturing organizations across North America, Asia, Africa, and Europe, "with victims selected based on their strategic interest to the Russian government," according to Talos researchers Sara McBroom and Brandon White. "We assess that the purpose of this campaign is to compromise and extract device configuration information en masse, which can later be leveraged as needed based on then-current strategic goals and interests of the Russian government," McBroom and White [6]wrote .

>

> And while both security alerts focus on the FSB's latest round of network intrusions, "many other state-sponsored actors also covet the access these devices afford," the Talos team warned. "Organizations should be aware that other advanced persistent threats (APTs) are likely prioritizing carrying out similar operations as well."

Some [7]context from Hot Hardware :

> Cisco indicated in its advisory that "Only Smart Install client switches are affected by the vulnerability". The list of affected devices is in Table A-1 here. For a successful attack, hackers exploit a vulnerability tracked as CVE-2018-0171. This was a vulnerability that was patched way back in 2018.



[1] https://thehill.com/policy/technology/5463287-russian-hackers-targeting-critical-infrastructure-it-systems-fbi/

[2] https://www.ic3.gov/PSA/2025/PSA250820

[3] https://blog.talosintelligence.com/static-tundra/

[4] https://www.theregister.com/2025/08/20/russian_fsb_cyberspies_exploiting_cisco_bug/

[5] https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20180328-smi2.html

[6] https://blog.talosintelligence.com/static-tundra/

[7] https://hothardware.com/news/fbi-warns-cisco-device-russian-hacking