CISA Advisory AA26-194A, published July 13, 2026, details how FSB Center 16 has been harvesting router configurations from critical infrastructure globally using a technique so straightforward it barely warrants the label “attack”: querying routers with default SNMP community strings (public/private) that were never changed from factory settings.

The technique is covered by ATT&CK T1602.002 (Network Device Configuration Dump) and T1602.001 (SNMP MIB Dump). The exfiltration path is typically TFTP (UDP 69) from the router to an FSB-controlled collection host. The good news is both the collection and the exfiltration are detectable at the network layer, and the Cisco Smart Install exploitation path generates specific log signatures.

Detection 1: SNMP MIB Walk from External Source

The primary indicator is an SNMP MIB walk or a targeted poll of the Cisco Config Copy OID tree (1.3.6.1.4.1.9.9.96) from an unexpected source. Most legitimate SNMP management comes from a small set of known management stations — anything outside that baseline is worth alerting on.

title: SNMP MIB Walk from Non-Management Source
id: a7f3c9e2-4b8d-4e1f-9c3a-d5e7f8b2a6c1
status: experimental
description: |
  Detects SNMP traffic from sources not in the approved management station
  list. FSB Center 16 (AA26-194A) uses SNMP MIB walks to retrieve router
  running configs via the Cisco Config Copy OID (1.3.6.1.4.1.9.9.96).
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-194a
author: SOC Analyst Hub
date: 2026-07-19
tags:
  - attack.collection
  - attack.t1602.002
  - attack.t1602.001
logsource:
  category: network
  definition: |
    Requires firewall or network flow logs with application-layer protocol
    identification, or dedicated SNMP monitoring via a network tap/SPAN.
detection:
  selection:
    protocol: 'UDP'
    dst_port: 161
  filter_management:
    src_ip|cidr:
      - '10.10.1.0/24'    # Approved SNMP management subnet - adjust to your env
      - '192.168.100.0/28' # Second approved management range
  condition: selection and not filter_management
falsepositives:
  - New monitoring tools onboarded without updating the management IP filter
  - Network discovery scans from authorised vulnerability scanners
level: high

Tuning note: The critical filter is your approved SNMP management station list. Any SNMP poll originating outside those CIDRs — especially from public IP space — is a high-fidelity indicator. Alert on UDP 161 from RFC 1918 ranges not in your management baseline too: an attacker who has already achieved internal network access will typically query routers from a compromised internal host.

Detection 2: Cisco Smart Install Exploitation (TCP 4786)

Cisco Smart Install listens on TCP 4786. Legitimate use is exclusively during zero-touch provisioning in controlled lab environments. Any traffic to TCP 4786 on a production router is anomalous. Active exploitation generates specific IOS syslog events.

title: Cisco Smart Install Exploitation Attempt
id: b8e4d1f3-6c2a-4f9e-8d4b-e3f1c7a9b5d2
status: experimental
description: |
  Detects exploitation of Cisco Smart Install (TCP 4786), a legacy
  provisioning protocol with no authentication. FSB Center 16 uses Smart
  Install to retrieve running configurations without credentials.
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-194a
  - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170214-smi
author: SOC Analyst Hub
date: 2026-07-19
tags:
  - attack.collection
  - attack.t1602.002
logsource:
  category: network
detection:
  selection_network:
    protocol: 'TCP'
    dst_port: 4786
  condition: selection_network
falsepositives:
  - Legitimate Smart Install provisioning in isolated staging networks
level: critical

IOS syslog correlation: Cisco IOS logs Smart Install events to syslog. Add these message IDs to your SIEM ingestion from syslog on network devices:

  • %SMART_INSTALL-5-DHCP_IN_USE — Smart Install is active and responding
  • %SMART_INSTALL-3-IMG_COPY — Firmware image copy in progress
  • %SYS-5-CONFIG_I alongside a non-local source — config applied from external

Detection 3: TFTP Config Exfiltration

After retrieving a running config via SNMP or Smart Install, the exfiltration path is typically TFTP (UDP 69) sending the config file to an external host. Outbound TFTP from a network device to an internet address is essentially never legitimate.

title: Outbound TFTP from Network Infrastructure Device
id: c9f5e2a4-7d3b-4e8f-9a5c-f4g2d8b6c3e7
status: experimental
description: |
  Detects outbound TFTP (UDP 69) traffic originating from router or switch
  management IP addresses to external destinations. Indicates potential
  config exfiltration following SNMP or Smart Install compromise.
author: SOC Analyst Hub
date: 2026-07-19
tags:
  - attack.exfiltration
  - attack.t1048
  - attack.collection
  - attack.t1602.002
logsource:
  category: network
detection:
  selection:
    protocol: 'UDP'
    src_port: 69
    src_ip|cidr:
      - '10.0.0.0/8'     # Adjust to your network device management ranges
      - '172.16.0.0/12'
  filter_internal:
    dst_ip|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter_internal
falsepositives:
  - Legitimate firmware upgrade workflows using internal TFTP servers (filter those dst_ips)
level: critical

KQL for Azure Sentinel / Microsoft Sentinel

If your firewall or network appliance logs flow into Sentinel, the following KQL queries cover the same detections using CommonSecurityLog or AzureFirewall log schema:

// SNMP to non-management destinations — KQL
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationPort == 161 and Protocol == "UDP"
| where not(SourceIP matches regex @"^10\.10\.1\.\d{1,3}$")   // Adjust management CIDRs
| where not(SourceIP matches regex @"^192\.168\.100\.\d{1,3}$")
| summarize Count = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by SourceIP, DestinationIP, DeviceVendor
| where Count > 5
| sort by Count desc
// Cisco Smart Install port TCP 4786 — KQL
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationPort == 4786 and Protocol == "TCP"
| project TimeGenerated, SourceIP, DestinationIP, DeviceVendor, DeviceAction
| sort by TimeGenerated desc
// Outbound TFTP from internal to external — KQL
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationPort == 69 and Protocol == "UDP"
| where SourceIP matches regex @"^(10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.)"
| where not(DestinationIP matches regex @"^(10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.)")
| project TimeGenerated, SourceIP, DestinationIP, DeviceVendor
| sort by TimeGenerated desc

Hunting: SNMP Community String Enumeration

Attackers testing which community strings work will generate repeated SNMP polls with SNMP error responses (GetResponse PDU with error status noSuchName or authorizationError). This looks like low-volume repeated UDP 161 traffic from a single source to a single destination with short intervals.

// SNMP community string enumeration pattern — KQL
CommonSecurityLog
| where TimeGenerated > ago(1h)
| where DestinationPort == 161 and Protocol == "UDP"
| summarize AttemptCount = count(), 
            FirstAttempt = min(TimeGenerated),
            LastAttempt = max(TimeGenerated)
    by SourceIP, DestinationIP
| where AttemptCount > 20
| extend Duration = datetime_diff("second", LastAttempt, FirstAttempt)
| where Duration < 300   // 20+ polls in under 5 minutes
| sort by AttemptCount desc

Alert Correlation

These three detections are most useful as a correlated alert:

  1. SNMP to router from unexpected source — collection initiated
  2. TCP 4786 connection to router — Smart Install exploitation
  3. Outbound TFTP from router management IP — exfiltration of collected config

Any single alert warrants investigation. All three within a 60-minute window from correlated source/destination IPs is a confirmed collection campaign. Triage by reviewing the SNMP walk results if available, identify what the router config would have contained (VPN PSKs, BGP neighbour auth, OSPF keys), and assume those credentials are burned.

Hardening to reduce detection burden

The detection burden goes to zero for Smart Install by running no vstack on IOS/IOS-XE and blocking TCP 4786 at the firewall. For SNMP, migrating to SNMPv3 with authPriv means an attacker can’t retrieve anything useful even if they discover the management port is accessible — there’s no community string to guess. These are the mitigations; the detections above cover the gap while remediation is in progress.