Russian Cyber Spy Group APT28 Backdoors Cisco Routers via SNMP

Russian-aligned cyber groups are seeking to target Western infrastructure, including Russian cyber spy group APT28 backdoors Cisco routers via SNMP

The UK's National Cyber Security Centre (NCSC) has warned that Russian-aligned cyber groups are seeking to target critical infrastructure in the West. The NCSC said that these groups are motivated more by ideology than by money, and that they pose a potential risk to crucial infrastructure systems in Western countries, especially those that are "poorly protected."

The NCSC said that the groups often focus on denial-of-service attacks, defacing websites and spreading misinformation. However, some of the groups have stated a desire to achieve a more disruptive and destructive impact against Western critical national infrastructure, including in the UK.

Without outside assistance, it is unlikely that the groups "have the capability to deliberately cause a destructive, rather than disruptive, impact in the short term." However, the NCSC warns that the groups may become more effective over time, and that organizations "act now to manage the risk against successful future attacks."

The NCSC has issued a number of recommendations to organizations to help them protect themselves from these threats. These include:

• Keeping software up to date

• Using strong passwords and multi-factor authentication

• Implementing a robust incident response plan

• Raising awareness of cyber security threats among employees

The NCSC also encourages organizations to report any suspicious activity to the NCSC or their local law enforcement agency.

The NCSC's warning comes as the UK and its allies continue to impose sanctions on Russia in response to its invasion of Ukraine. The NCSC said that the sanctions are likely to further motivate Russian-aligned cyber groups to target Western infrastructure.

The NCSC's warning is a reminder that cyber security is a top priority for organizations of all sizes. By taking steps to protect themselves from cyber threats, organizations can help to mitigate the risk of disruption and damage.

In addition to the NCSC's warning, it has also been reported that Russian cyber spy group APT28 has been backdooring Cisco routers via SNMP. APT28, also known as Fancy Bear or Sednit, is a Russian state-sponsored hacking group that has been linked to a number of high-profile cyberattacks, including the 2016 Democratic National Committee email hack.

The backdoor in Cisco routers is believed to have been used by APT28 to gain access to networks and steal sensitive data. The backdoor was discovered by researchers at Cisco Talos, who have released a report on the vulnerability.

The vulnerability is a remote code execution (RCE) vulnerability that affects Cisco IOS 15.2 and earlier versions. The vulnerability can be exploited by an attacker who can send a specially crafted packet to a vulnerable router.

Cisco has released a patch for the vulnerability. Organizations that are using Cisco IOS 15.2 or earlier versions should apply the patch as soon as possible.

The discovery of the backdoor in Cisco routers is a reminder that cyber threats are constantly evolving. Organizations need to be aware of the latest threats and take steps to protect themselves.

This vulnerability is one of several SNMP flaws that Cisco patched on June 29, 2017. Its exploitation requires an attacker to be able to access the vulnerable SNMP OID. For this, they first need to know the SNMP read-only credential, but these are not always hard to find.

Here are some tips for protecting your Cisco routers from this vulnerability:

• Keep your software up to date. Cisco has released a patch for this vulnerability. Organizations that are using Cisco IOS 15.2 or earlier versions should apply the patch as soon as possible.

• Use strong passwords and multi-factor authentication. Make sure that your SNMP credentials are strong and that you are using multi-factor authentication.

• Implement a robust incident response plan. Have a plan in place in case your network is compromised. This plan should include steps for containing the breach, notifying affected parties, and recovering from the attack.

• Raise awareness of cyber security threats among employees. Make sure that your employees are aware of the latest cyber threats and how to protect themselves.

In conclusion, the discovery of the backdoor in Cisco routers is a reminder that cyber threats are constantly evolving. Organizations need to be aware of the latest threats and take steps to protect themselves. By taking steps to protect yourself from cyber threats, you can help to mitigate the risk of disruption and damage.

CEOs / CISOs Cybersecurity Plans For 2023 and 2024 (Copy)

CEOs and CISOs have a crucial role in ensuring cybersecurity for their organizations. Their focus is on protecting sensitive information and critical assets from cyber threats such as data breaches, hacks, and cyber attacks. To achieve this, they must implement a comprehensive cybersecurity strategy that addresses all aspects of security, including people, processes, and technology.

Regarding people, CEOs and CISOs must ensure that employees and contractors are trained in cybersecurity best practices and aware of their roles and responsibilities when it comes to protecting company data. They should also implement policies and procedures that promote a culture of security and accountability throughout the organization.

Regarding processes, CEOs and CISOs must establish and enforce policies and procedures that govern how information is accessed, used, and stored. They must also ensure that security measures are integrated into all stages of the software development lifecycle and that regular security assessments are conducted to identify vulnerabilities and risks.

Regarding technology, CEOs and CISOs must deploy and maintain a suite of security technologies that are designed to protect against cyber threats. This includes firewalls, intrusion detection systems, antivirus software, and encryption tools, among others. They must also stay current with the latest security trends and technologies and be prepared to implement new measures as needed to address emerging threats.

Overall, CEOs and CISOs must work together to develop and implement a holistic cybersecurity strategy that addresses people, processes, and technology. By doing so, they can help protect their organizations from cyber threats and maintain the confidentiality, integrity, and availability of their data and assets.

CEOs and CISOs are focused on ensuring cybersecurity through a combination of people, process, and technology measures.

Some of the steps that CEOs and CISOs may take to ensure cybersecurity in 2023 include:

1. Increasing awareness and training: CEOs and CISOs may focus on increasing employee awareness of cybersecurity risks and providing training to help employees identify and avoid potential threats.

2. Strengthening policies and procedures: CEOs and CISOs may review and update their organization's policies and procedures to ensure they are aligned with the latest industry best practices and regulations.

3. Implementing advanced technologies: CEOs and CISOs may leverage advanced cybersecurity technologies, such as AI-powered threat detection and response tools, to improve their organization's ability to identify and respond to threats.

4. Conducting regular audits and assessments: CEOs and CISOs may conduct regular cybersecurity audits and assessments to identify potential vulnerabilities and develop plans to address them.

Artificial Intelligence Enhances Cyber Security

AI is playing a critical role in protecting organizations by providing advanced threat detection and response capabilities. AI-powered cybersecurity tools can analyze vast amounts of data in real-time to identify patterns and anomalies that could indicate a potential threat. AI can also help automate the incident response process, enabling organizations to respond to threats faster and more effectively.

Furthermore, AI is also used to improve the security of the software development lifecycle (SDLC) and the security of software applications themselves. By automating security testing and analysis, AI can help identify vulnerabilities in applications before they are deployed, reducing the risk of cyber attacks.

In summary, CEOs and CISOs are likely to focus on a combination of people, process, and technology measures to ensure cybersecurity in 2023, and AI is playing a critical role in protecting organizations by providing advanced threat detection and response capabilities and improving the security of the SDLC and software applications.