Not lone hackers, but intelligence agents from the FSB
The U.S. State Department has announced a $10 million reward for information that will help apprehend three Russians suspected of large-scale cyber attacks on critical U.S. infrastructure. But it's not just "hackers from the basement" who know this. According to the authorities, they are Russian intelligence officers affiliated with the FSB's Center 16, known in the cybersecurity world as Berserk Bear.
Their task is not to steal money or install a ransomware program. Their goal is to collect data, draw up network diagrams, and gain access to management systems. Prepare for the future, not for the chaos of today.
Hacking through a vulnerability in old hardware
The most striking thing is that they did not use state—of-the-art exploits, but the long-known vulnerability CVE-2018-0171 in Cisco routers. The problem is that this equipment is still used in thousands of organizations, and not all of them have updated it. The attackers found such nodes, gained access, and began to move around the network unnoticed.
This is not hacking, but penetration. It was quiet and methodical, like intelligence during the Cold War, but instead of spies with cameras, there were codes and logins.
Targets — Nuclear power plants, oil and gas industry, electric networks
Since 2012, the group has allegedly attacked more than 3,300 people in 500 organizations around the world. The main targets are energy: oil and gas companies, nuclear power plants, utilities, and power grid operators. They didn't turn off the lights —they studied how to do it.
Their job is to prepare the ground. Assemble a network map, find out who has access to SCADA systems, and what protocols are used. If you ever need to turn off the station or change the data, everything will be ready.
How they caught a break-in at a nuclear power plant
One of the most disturbing episodes is the attack on the Wolf Creek nuclear power plant in Kansas. The suspects deployed spyware that collected the credentials of employees who had access to critical systems. The hack was detected not by automation, but because the operators themselves suspected something was wrong and contacted the FBI.
This shows that the main vulnerability is not in the hardware, but in the fact that no one expected such an attack. And now the United States is deciding differently - not just blocking IP addresses, but hunting down the agents themselves.
Sources
- IndustrialCyber.co — FBI warning on Russian FSB Center 16 & Cisco CVE-2018-0171
- Utility Dive — ongoing attacks and vulnerability exploitation
- FBI IC3 — official bulletin on FSB-linked cyber campaigns
- SecurityMedia.org — Cisco flaw and Russian hacker activity
- CyberScoop — investigation of Static Tundra group tied to FSB Center 16