Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting

MITRE Techniques

• [T1595.001] Active Scanning: Scanning IP Blocks – The actors scan Internet IP ranges to find exposed devices [(‘scan range of IP addresses’)]
• [T1595.002] Active Scanning: Vulnerability Scanning – They scan for vulnerable or misconfigured devices that can be exploited [(‘scan victims for vulnerabilities that can be used during targeting’)]
• [T1583.003] Acquire Infrastructure: Virtual Private Servers – They use leased VPS infrastructure to receive stolen data and support operations [(‘transfer the file … to an actor-controlled leased virtual private server (VPS)’)]
• [T1584.008] Compromise Infrastructure: Network Devices – They compromise intermediate routers as part of their infrastructure [(‘compromise intermediate routers’)]
• [T1588.005] Obtain Capabilities: Exploits – They use publicly available exploit code against vulnerable devices [(‘use publicly available code to exploit vulnerable devices’)]
• [T1190] Exploit Public-Facing Application – They exploit public-facing Cisco CVEs and management portals [(‘exploit publicly known CVEs’)]
• [T1090] Proxy – They run scans via proxies and use VPS/compromised servers as relay infrastructure [(‘scans, run via proxies’)]
• [T1569] System Services – They execute commands through SNMP on network devices [(‘executing commands via SNMP’)]
• [T1068] Exploitation for Privilege Escalation – They exploit known CVEs to gain elevated access [(‘exploit publicly known CVEs for escalated privileges’)]
• [T1027] Obfuscated Files or Information – They spoof the source IP address so activity appears to come from another host [(‘containing … from a spoofed IP address’)]
• [T1003] OS Credential Dumping – They collect router configurations containing weak Cisco password types [(‘collect router configuration with weak Cisco Type 7 passwords and Type 0’)]
• [T1602.001] Data from Configuration Repository: SNMP (MIB Dump) – They target MIB data to gather network information [(‘Target MIB to collect network information via SNMP’)]
• [T1602.002] Data from Configuration Repository: Network Device Configuration Dump – They copy device configs to obtain credentials and settings [(‘copy its configuration to a file’)]
• [T1071] Application Layer Protocol – They use TFTP and FTP to move data and expose services [(‘including TFTP and FTP’)]
• [T1048] Exfiltration Over Alternative Protocol – They exfiltrate data over TFTP instead of the primary C2 channel [(‘Exfiltrating over a different protocol than that of the existing command and control channel’)]