Russian Hackers Exploit Old Cisco Vulnerabilities in Critical Infrastructure Attacks

The FBI has highlighted a concerning cyber threat involving Russian hackers who have infiltrated thousands of networking devices linked to critical infrastructure IT systems, utilizing a seven-year-old vulnerability in older Cisco software.

Cisco Talos, the company’s threat intelligence unit, reported that the group targeted organizations in sectors like telecommunications, higher education, and manufacturing across North America, Asia, Africa, and Europe. The hackers did not demand ransom but instead chose targets based on their “strategic interest” to Russia, as detailed in the Cisco Talos blog.

Static Tundra: Russian State-Sponsored Espionage Group

The hacking group is known as Static Tundra. According to the report, this Russian state-sponsored cyber espionage operation aims to extract large-scale device configuration information for use based on current strategic goals and interests of the Russian government.

“Attacks from Russia are not unusual, but critical infrastructure faces increased risk during times of geopolitical tension,” noted Tracy Goldberg, Director of Cybersecurity at Javelin Strategy & Research. “Recent diplomatic efforts between Russia and the U.S., aimed at ending the conflict in Ukraine, could shift cybersecurity dynamics, making industries like finance and industry particularly vulnerable.”

Long-Term and Undetected Intrusions

The investigation revealed that Static Tundra has been active for over a decade, maintaining undetected access to targets. In recent attacks, hackers modified configuration files to enable unauthorized access to devices, then conducted reconnaissance within the victim networks, showing particular interest in industrial control system protocols and applications.

Exploiting Old Software Flaws

The group exploited a seven-year-old vulnerability in Cisco IOS software by targeting unpatched and end-of-life network devices. “Most cyber adversaries, including Russia, can be deterred with zero-trust policies and regular testing and patching,” Goldberg advised. Financial institutions should review their disaster recovery plans before the third and fourth quarters of 2025 to ensure robust cyberthreat response.