{"id":51538,"date":"2023-04-19T21:40:00","date_gmt":"2023-04-19T21:40:00","guid":{"rendered":"https:\/\/www.darkreading.com\/attacks-breaches\/russian-fancy-bear-apt-exploited-unpatched-cisco-routers-to-hack-us-eu-government-agencies"},"modified":"2023-04-19T21:40:00","modified_gmt":"2023-04-19T21:40:00","slug":"russian-fancy-bear-apt-exploited-unpatched-cisco-routers-to-hack-us-eu-govt-agencies","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/russian-fancy-bear-apt-exploited-unpatched-cisco-routers-to-hack-us-eu-govt-agencies\/","title":{"rendered":"Russian Fancy Bear APT Exploited Unpatched Cisco Routers to Hack US, EU Gov’t Agencies"},"content":{"rendered":"
<\/div>\n

As recently as 2021, the notorious Russian APT28 was exploiting network routers running outdated versions of Cisco’s IOS and IOS XE operating system software, using them to deploy backdoors in networks across European and American government institutions.<\/p>\n

APT28 \u2014 aka Fancy Bear, Strontium, Tsar Team, and Sofacy Group \u2014 is best known for its campaigns against Ukraine<\/span><\/a> and <\/span>the 2016 US elections<\/span><\/a>. The UK National Cyber Security Centre (NCSC) has attributed this group to the 85th Special Service Centre, Military Intelligence Unit 26165, part of Russia’s General Staff Main Intelligence Directorate (GRU).<\/span><\/p>\n

NCSC, National Security Agency, Cybersecurity and Infrastructure Security Agency (CISA), and FBI this week <\/span>published a joint advisory<\/span><\/a> outlining one of APT28’s less technically impressive but more economic maneuvers. According to their findings, the group used unpatched Cisco routers to access “a small number” of EU and US government institutions, on top of “approximately 250 Ukrainian victims.”<\/span><\/p>\n

Though the campaign took place two years ago, <\/span><\/span><\/span>Cisco Talos in a blog post<\/span><\/a> expressed how “deeply concerned” it is “by an increase in the rate of high-sophistication attacks on network infrastructure” by nation-state actors.<\/span><\/p>\n

“We certainly have seen an increase over the last several years \u2014 even over the last six to 12 months \u2014 in targeting this type of infrastructure,” says JJ Cummings, national security principal at Cisco Talos. “I think this is probably only the tip of the iceberg.”<\/span><\/p>\n

Taking Advantage of Vulnerable Routers<\/h2>\n

On June 29, 2017, Cisco revealed a series of vulnerabilities<\/span><\/a> in the Simple Network Management Protocol (SNMP), a communications protocol for network devices running IOS versions 12.0 through 12.4 and 15.0 through 15.6, and IOS XE 2.2 through 3.17.<\/span><\/p>\n

A specially crafted SNMP packet, the company explained, could have allowed attackers to remotely execute code on affected devices, or cause them to reboot. The vulnerabilities were grouped under <\/span>CVE-2017-6742<\/span><\/a> and assigned a “High” CVSS score of 8.8.<\/span><\/p>\n

Though a patch for the SNMP vulnerabilities was released all those years ago, by 2021 APT28 was still exploiting Cisco routers to access US, EU, and primarily Ukrainian government networks.<\/span><\/p>\n

In the same way administrators use SNMP to remotely monitor and configure network devices, APT28 used it to remotely access devices and penetrate networks.<\/span><\/p>\n

“A number of software tools can scan the entire network using SNMP,” the advisory explained, “meaning that poor configuration such as using default or easy-to-guess community strings, can make a network susceptible to attacks.”<\/span><\/p>\n

In particular, APT28 took advantage of weak passwords \u2014 “community strings,” in Cisco parlance \u2014 such as the default public string in order to crack routers and, in some cases, deploy their <\/span>“Jaguar Tooth” malware<\/span><\/a>. Jaguar Tooth was specifically designed to exploit CVE-2017-6742, stealing device information and planting a backdoor for persistent access.<\/span><\/p>\n

Thousands of Routers Are Exposed Online<\/h2>\n

A remarkable number of enterprise Internet routers <\/span><\/a>in operation today are publicly exposed on the open Internet. And they’re not only exposed \u2014 they’re vulnerable. For scale, consider this:<\/span><\/p>\n

After a series of vulnerabilities were discovered in <\/span>multiple Cisco Small Business Routers<\/span><\/a> earlier this year, software company Censys scanned for any potentially vulnerable devices online. The search returned over 20,000 results, the vast majority of which are <\/span>still equally exposed to this day<\/span><\/a>.<\/span><\/p>\n

And just as a software company can identify these devices, so can hackers.” Usually, cybercriminals will be using tools like Shodan or Nmap to scan and look for exposed devices connected to the internet,” explains James McQuiggan, security awareness advocate at KnowBe4. “Organizations may try the ‘security by obscurity’ model, hoping they’re not discovered running older legacy systems,” he says, but hackers who can find and so easily exploit these devices “have opened the electronic front door.”<\/p>\n

Cisco regularly publishes information about new vulnerabilities and risks to IT infrastructure, such as <\/span>this blog post published on April 18<\/span><\/a><\/p>\n

Why Routers Go Unpatched<\/h2>\n

In IT environments, Cummings observes, there’s one main reason why routing devices remain unpatched for years at a time. “Think about what the primary mission of a network operations team is: to keep the network up and running, right?” A byproduct of this prioritization of reliability and availability, he says, could be that “if a device is not broken, maybe they’re not going to fix it.”<\/p>\n

Further, updating can sometimes come at a cost \u2014 albeit temporary \u2014 for operations. “We’ve seen in a couple of cases that, while the process to upgrade isn’t necessarily difficult or arduous, it’s also not always without risk for network availability.” If availability is the primary goal, “if they’re incentivized not to impact that, anything that gets in the way is something that they’re going to shy away from.”<\/p>\n

Updating IOS and IOS XE is necessary for addressing CVE-2017-6742, but in cases where doing so is tricky, there are other simple changes IT administrators can make to harden against similar infrastructure breaches. “If updates are not possible,” McQuiggan says, “network monitoring \u2014 even if it’s by a third-party managed security service \u2014 can alert of intrusions and possible unauthorized logins to external-facing networking equipment.”<\/p>\n

In its blog post, Cisco emphasized more than anything the need to restrict infrastructure to trusted users. “Designed to prevent unauthorized direct communication to network devices, infrastructure access control lists (ACLs) are one of the most critical security controls that can be implemented in networks,” they wrote. “Exploitation of these vulnerabilities is best prevented by restricting access to trusted administrators and IP addresses.”<\/p>\n

Read More HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

The nation-stage threat group deployed custom malware on archaic versions of Cisco’s router operating system. Experts warn that such attacks targeting network infrastructure are on the rise.Read More HERE<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[151],"tags":[],"class_list":["post-51538","post","type-post","status-publish","format-standard","hentry","category-darkreading-ti"],"yoast_head":"\nRussian Fancy Bear APT Exploited Unpatched Cisco Routers to Hack US, EU Gov't Agencies 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/russian-fancy-bear-apt-exploited-unpatched-cisco-routers-to-hack-us-eu-govt-agencies\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Russian Fancy Bear APT Exploited Unpatched Cisco Routers to Hack US, EU Gov't Agencies 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/russian-fancy-bear-apt-exploited-unpatched-cisco-routers-to-hack-us-eu-govt-agencies\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2023-04-19T21:40:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/bltb8ccc4529ca8208c\/61eec1b6252c077e96a2dc29\/RussianMap_Miceking_Alamy.jpg\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-fancy-bear-apt-exploited-unpatched-cisco-routers-to-hack-us-eu-govt-agencies\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-fancy-bear-apt-exploited-unpatched-cisco-routers-to-hack-us-eu-govt-agencies\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Russian Fancy Bear APT Exploited Unpatched Cisco Routers to Hack US, EU Gov’t Agencies\",\"datePublished\":\"2023-04-19T21:40:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-fancy-bear-apt-exploited-unpatched-cisco-routers-to-hack-us-eu-govt-agencies\\\/\"},\"wordCount\":905,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-fancy-bear-apt-exploited-unpatched-cisco-routers-to-hack-us-eu-govt-agencies\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/bltb8ccc4529ca8208c\\\/61eec1b6252c077e96a2dc29\\\/RussianMap_Miceking_Alamy.jpg\",\"articleSection\":[\"DarkReading |TI\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-fancy-bear-apt-exploited-unpatched-cisco-routers-to-hack-us-eu-govt-agencies\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-fancy-bear-apt-exploited-unpatched-cisco-routers-to-hack-us-eu-govt-agencies\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-fancy-bear-apt-exploited-unpatched-cisco-routers-to-hack-us-eu-govt-agencies\\\/\",\"name\":\"Russian Fancy Bear APT Exploited Unpatched Cisco Routers to Hack US, EU Gov't Agencies 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-fancy-bear-apt-exploited-unpatched-cisco-routers-to-hack-us-eu-govt-agencies\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-fancy-bear-apt-exploited-unpatched-cisco-routers-to-hack-us-eu-govt-agencies\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/bltb8ccc4529ca8208c\\\/61eec1b6252c077e96a2dc29\\\/RussianMap_Miceking_Alamy.jpg\",\"datePublished\":\"2023-04-19T21:40:00+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-fancy-bear-apt-exploited-unpatched-cisco-routers-to-hack-us-eu-govt-agencies\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-fancy-bear-apt-exploited-unpatched-cisco-routers-to-hack-us-eu-govt-agencies\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-fancy-bear-apt-exploited-unpatched-cisco-routers-to-hack-us-eu-govt-agencies\\\/#primaryimage\",\"url\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/bltb8ccc4529ca8208c\\\/61eec1b6252c077e96a2dc29\\\/RussianMap_Miceking_Alamy.jpg\",\"contentUrl\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/bltb8ccc4529ca8208c\\\/61eec1b6252c077e96a2dc29\\\/RussianMap_Miceking_Alamy.jpg\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-fancy-bear-apt-exploited-unpatched-cisco-routers-to-hack-us-eu-govt-agencies\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Russian Fancy Bear APT Exploited Unpatched Cisco Routers to Hack US, EU Gov’t Agencies\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Russian Fancy Bear APT Exploited Unpatched Cisco Routers to Hack US, EU Gov't Agencies 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/russian-fancy-bear-apt-exploited-unpatched-cisco-routers-to-hack-us-eu-govt-agencies\/","og_locale":"en_US","og_type":"article","og_title":"Russian Fancy Bear APT Exploited Unpatched Cisco Routers to Hack US, EU Gov't Agencies 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/russian-fancy-bear-apt-exploited-unpatched-cisco-routers-to-hack-us-eu-govt-agencies\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2023-04-19T21:40:00+00:00","og_image":[{"url":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/bltb8ccc4529ca8208c\/61eec1b6252c077e96a2dc29\/RussianMap_Miceking_Alamy.jpg","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/russian-fancy-bear-apt-exploited-unpatched-cisco-routers-to-hack-us-eu-govt-agencies\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/russian-fancy-bear-apt-exploited-unpatched-cisco-routers-to-hack-us-eu-govt-agencies\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Russian Fancy Bear APT Exploited Unpatched Cisco Routers to Hack US, EU Gov’t Agencies","datePublished":"2023-04-19T21:40:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/russian-fancy-bear-apt-exploited-unpatched-cisco-routers-to-hack-us-eu-govt-agencies\/"},"wordCount":905,"commentCount":0,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/russian-fancy-bear-apt-exploited-unpatched-cisco-routers-to-hack-us-eu-govt-agencies\/#primaryimage"},"thumbnailUrl":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/bltb8ccc4529ca8208c\/61eec1b6252c077e96a2dc29\/RussianMap_Miceking_Alamy.jpg","articleSection":["DarkReading |TI"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.threatshub.org\/blog\/russian-fancy-bear-apt-exploited-unpatched-cisco-routers-to-hack-us-eu-govt-agencies\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/russian-fancy-bear-apt-exploited-unpatched-cisco-routers-to-hack-us-eu-govt-agencies\/","url":"https:\/\/www.threatshub.org\/blog\/russian-fancy-bear-apt-exploited-unpatched-cisco-routers-to-hack-us-eu-govt-agencies\/","name":"Russian Fancy Bear APT Exploited Unpatched Cisco Routers to Hack US, EU Gov't Agencies 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/russian-fancy-bear-apt-exploited-unpatched-cisco-routers-to-hack-us-eu-govt-agencies\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/russian-fancy-bear-apt-exploited-unpatched-cisco-routers-to-hack-us-eu-govt-agencies\/#primaryimage"},"thumbnailUrl":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/bltb8ccc4529ca8208c\/61eec1b6252c077e96a2dc29\/RussianMap_Miceking_Alamy.jpg","datePublished":"2023-04-19T21:40:00+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/russian-fancy-bear-apt-exploited-unpatched-cisco-routers-to-hack-us-eu-govt-agencies\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/russian-fancy-bear-apt-exploited-unpatched-cisco-routers-to-hack-us-eu-govt-agencies\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/russian-fancy-bear-apt-exploited-unpatched-cisco-routers-to-hack-us-eu-govt-agencies\/#primaryimage","url":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/bltb8ccc4529ca8208c\/61eec1b6252c077e96a2dc29\/RussianMap_Miceking_Alamy.jpg","contentUrl":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/bltb8ccc4529ca8208c\/61eec1b6252c077e96a2dc29\/RussianMap_Miceking_Alamy.jpg"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/russian-fancy-bear-apt-exploited-unpatched-cisco-routers-to-hack-us-eu-govt-agencies\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Russian Fancy Bear APT Exploited Unpatched Cisco Routers to Hack US, EU Gov’t Agencies"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/51538","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=51538"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/51538\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=51538"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=51538"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=51538"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}