{"uuid": "65475c31-3278-4f5c-82f5-dccd1cc19b72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-6742", "type": "seen", "source": "https://t.me/hacking_Attack/98554", "content": "Black Hat Ethical Hacking\nAPT28 Hackers Target Cisco Routers with Custom Malware\n\nAPT28 Hackers Target Cisco Routers with Custom MalwarePost Views: 6 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Cisco routers targeted with \u2018Jaguar Tooth\u2019 malware by Russian hacking group APT28US and UK intelligence agencies, along with Cisco, have issued a joint report warning about state-sponsored APT28 hackers who are exploiting an old SNMP flaw on Cisco IOS routers.\n\nAPT28 is a Russian hacking group that has been linked to Russia\u2019s General Staff Main Intelligence Directorate (GRU), and is known for conducting cyber espionage against European and US interests. The group has been using a custom malware named \u2018Jaguar Tooth\u2019 to gain unauthenticated access to the targeted devices.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses APT28 group\u2019s Jaguar Tooth malware through SNMP exploitJaguar Tooth is malware that targets Cisco IOS routers running firmware: C5350-ISM, Version 12.3(6), and once installed, it exfiltrates information from the router and provides unauthenticated backdoor access to the device. The malware is injected directly into the memory of Cisco routers running older firmware versions, exploiting the CVE-2017-6742 SNMP vulnerability, fixed in June 2017.\n\nThe threat actors scan for public Cisco routers using weak SNMP community strings, and if they find a valid SNMP community string, they exploit the vulnerability to gain access to the router\u2019s memory and install Jaguar Tooth.\n\nThe report highlights a growing trend of state-sponsored threat actors creating custom malware for networking devices to conduct cyber espionage and surveillance.\nTrending: The Rise and Fall of Sabu: From Hacker Hero to FBI Informant Trending: Offensive Security Tool: Mythic Best practices to mitigate the APT28 threat on Cisco routers.The agencies recommend upgrading routers to the latest firmware, switching from SNMP to NETCONF/RESTCONF, and disabling SNMP v2 or Telnet on Cisco routers. If a device is suspected of being compromised, CISA recommends using Cisco\u2019s advice for verifying the integrity of the IOS image, revoking all keys associated with the device, and replacing images with those directly from Cisco.\nTrending: 10-Year-Old Windows vulnerability still being exploited in the 3CX attacks\nAre u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSource: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Store.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/04/Images-for-the-News-posts-18-300x150.png Chinese hacking group APT41 caught using Google tool for data theftApril 18, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/04/Images-for-the-News-posts-17-300x150.png LockBit Ransomware Gang Testing First-Ever Ransomware for macOSApril 17, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/04/Images-for-the-News-posts-16-300x150.png Meet \u2018Legion\u2019: The New Python-Based Credential Harvester and SMTP Hijacking ToolApril 14, 2023\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/04/Images-for-the-News-posts-15-300x150.png New generation of botnets builds high-performance VPS-based DDoS attacksApril 13, 2023 https://www.blackhatethicalhacking.com/wp-content/uploads[...]", "creation_timestamp": "2026-09-01T20:00:59.650493Z"}