Static Tundra
Static Tundra is a threat actor group with an ideological motive, tracked by Brandefense. It exploits 1 known CVE.
- Techniques
- 0
- Exploited CVEs
- 1
- First seen
- Sep 11, 2025
- Last seen
- Sep 11, 2025
- Record updated
About Static Tundra.
For more than a decade it has compromised networking devices, especially unpatched and end-of-life Cisco IOS and IOS XE gear, by exploiting Smart Install CVE-2018-0171 (patched in 2018) and weak SNMP community strings such as public and anonymous. After access, operators spawn TFTP, exfiltrate startup-config, harvest credentials, and persist for long-term traffic collection. Primary sectors include telecommunications, higher education, and manufacturing across North America, Asia, Africa, and Europe, with victims selected for Russian government interest, including Ukraine and allied countries. The FBI has warned of continued exploitation of discontinued devices.
Last updated Sep 12, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.