Russian hackers target opening in Cisco switch security

Cisco has warned enterprises that nation-state hackers -- some possibly from Russia -- are targeting a vulnerability in its switches that could let an attacker compromise corporate networks and critical U.S. infrastructure.

The advisory, issued late last week, reported "several incidents in multiple countries, including some specifically targeting critical infrastructure," had involved the known vulnerability in the Cisco Smart Install Client. The legacy utility lets organizations automate the process of installing switches.

Some of the attacks aimed at bypassing Cisco switch security were believed to be part of Russian government cyberactivity reported last month by an agency of the U.S. Department of Homeland Security (DHS), Cisco's Talos security group said in a blog post.

"As a result, we are taking an active stance, and are urging customers, again, of the elevated risk and available remediation paths," Talos said.

The U.S. Computer Emergency Readiness Team (US-CERT) within the DHS issued an alert that said Russian attackers were targeting the energy, nuclear, water, aviation and critical manufacturing sectors.

Attackers had been successful against some small facilities in the U.S. energy sector, the US-CERT alert said. The hackers penetrated the networks through malware and spear phishing and stole information on industrial control systems. Spear phishing is a technique in which carefully crafted emails are used to trick the recipient into opening a malicious attachment.