Static Tundra is Cisco Talos’s name for a Russian state-sponsored cluster attributed to the FSB’s Center 16 unit, corroborated by an August 2025 FBI advisory. The attribution to Russia/FSB is high confidence. Talos assesses, at moderate confidence, that Static Tundra is a sub-cluster of or associated with Energetic Bear (Berserk Bear) — the lineage MITRE tracks as Dragonfly (G0035) — based on overlapping TTPs and victimology; treat that as an association, not a confirmed identity. Static Tundra itself has no standalone MITRE group ID.
Attribution & Lineage
Talos does not equate Static Tundra with Berserk Bear outright. It assesses a moderate-confidence association with Energetic Bear (Berserk Bear / Dragonfly, G0035) and, separately, a moderate-confidence association with the historic 2015 SYNful Knock Cisco implant activity. The Russia/FSB Center 16 attribution is the high-confidence part.
Targeting
Telecommunications, higher education and manufacturing are named as primary sectors; victims span North America, Asia, Africa and Europe, with reporting emphasising Ukraine and strategic-interest countries. The group targets unpatched and end-of-life network edge devices — Cisco IOS and IOS XE routers and switches.
Notable Activity
- 2015: historic SYNful Knock Cisco implant activity (associated, moderate confidence).
- 2021–2025: sustained exploitation of Cisco Smart Install (commonly cited as CVE-2018-0171), alongside an SNMP vector, to steal device configurations and maintain long-term access.
- August 2025: joint Cisco Talos research and an FBI advisory warning of ongoing FSB Center 16 exploitation of SNMP and end-of-life Cisco devices, with expanded operations tied to Russia’s war in Ukraine.
Malware & Tooling
SYNful Knock — a malicious Cisco IOS firmware/bootloader modification giving reboot persistence and a stealthy, packet-activated modular backdoor (association assessed at moderate confidence). Beyond it, the group relies heavily on living-off-the-network-device techniques — SNMP, TFTP and configuration theft — rather than a large bespoke malware catalogue.
MITRE ATT&CK Mapping
No standalone ATT&CK group ID; the associated lineage is Dragonfly (G0035). Techniques below are mapped from reported behaviour.
| Tactic | Technique | Usage |
|---|---|---|
| Initial Access | T1190 Exploit Public-Facing App | Cisco Smart Install; weak SNMP |
| Collection | T1602.002 Network Device Config Dump | Config theft |
| Collection | T1602.001 SNMP (MIB Dump) | SNMP abuse |
| Persistence | T1542.001 System Firmware | SYNful Knock implant |
| Exfiltration | T1048 Exfil Over Alternative Protocol | TFTP config exfil |
Detection & Mitigation
- Patch CVE-2018-0171 or disable Smart Install with
no vstack; retire and replace end-of-life Cisco devices that no longer receive fixes. - Lock down SNMP: eliminate default and weak community strings, prefer SNMPv3 with authentication and privacy, and restrict SNMP and TFTP by ACL to known management hosts only.
- Scan for SYNful Knock with Cisco/Talos tooling; monitor for unexpected configuration reads/changes, anomalous TFTP transfers and firmware/image integrity drift.
Harden Network Infrastructure
Mjolnir Security helps organisations secure routers, switches and end-of-life network devices.
- Attack Surface Management Finding exposed Smart Install and SNMP services and end-of-life devices.
- Compromise Assessment Hunting for firmware implants and configuration theft.
- 24/7 Incident Response Containment when network-device compromise is suspected. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts