Twenty-one agencies, eleven countries, and the logs were deleted
Twenty-one agencies from eleven countries put their seals on this advisory, which is the first thing to notice about it. PRC state-sponsored actors have been inside telecommunications backbone routers, provider edge and customer edge routers since at least 2021, and have used those compromised devices and their trusted connections to pivot into further networks. The named sectors are telecommunications, government, transportation, lodging and military infrastructure. The equipment spans Cisco IOS XE, NX-OS and IOS XR, Palo Alto PAN-OS and Ivanti Connect Secure, with Juniper, Fortinet, Nokia, Sierra Wireless and SonicWall suspected. What is taken is call data logs, a limited number of private communications, and material subject to court-ordered law enforcement requests.
What worked
The advisory does not say. It notes a single case in which "The APT actors were stopped before further actions could be taken" and gives no account of how, which is the only defensive outcome in the whole document.
What failed
The evidence, deliberately. This is the entry in this section where the forensic failure is the finding.
The actors modify access control lists to add their own IP addresses, so their traffic is permitted by policy rather than hidden from it. Then they disable logging, stop logs reaching central servers, delete and clear what is on the device, and revert configuration files so the modifications leave no trace. An investigation that starts on the router starts with nothing.
Underneath that sit the ordinary failures the advisory describes as avoidable. Five exploited vulnerabilities, the oldest from 2018, all with patches available. Weak and default SNMP community strings. TACACS+ and RADIUS traffic in cleartext or weakly protected forms. Cisco Type 5 and Type 7 password storage where Type 8 belongs. Management services listening on the internet. Guest Shell enabled on devices that have no use for it, which the advisory notes is "not monitored closely".
The number
21 agencies
from eleven countries co-sealed this advisory, which is a fair proxy for how widely the same actors were found in the same kind of equipment.
What to do instead
Get the logs off the device first, before anything else on this list. The actors’ entire evasion strategy is to control what the router remembers, and it only works while the router is the only place that record lives. Forward to a central server with immutable storage and a retention period long enough to investigate with, at informational level or better, and treat a device that stops sending as an incident rather than as a monitoring gap.
Then move the management plane out of reach. CISA’s wording is to place every management service, SSH, HTTPS, SNMP, TACACS+, RADIUS, SCP and SFTP, strictly into a dedicated out-of-band management network or a management VRF. That one change removes most of what the rest of the advisory describes.
Then patch the five and fix the defaults. CVE-2024-21887, CVE-2024-3400, CVE-2023-20273, CVE-2023-20198 and CVE-2018-0171 are the priority list. Change every weak and default SNMP community string and move to SNMPv3 only. Switch to Type 8 password storage. Require public-key authentication for administrators and disable password authentication where you can. Turn off Guest Shell and Smart Install.
And audit the configuration as a detection rather than as housekeeping. An access control list carrying an address nobody recognises, an unexpected tunnel, a new SPAN or ERSPAN session, a packet capture command, a TACACS+ redirect: each is a specific thing to go and look for, and not one of them will alert on its own.
- PrimaryCISA AA25-239A