Jaguar Tooth
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
It has been observed being deployed and executed via exploitation of the patched SNMP vulnerability CVE-2017-6742. ... If a valid SNMP community string is discovered, the threat actors exploit the CVE-2017-6742 SNMP vulnerability, fixed in June 2017. This vulnerability is an unauthenticated, remote code execution flaw with publicly available exploit code. | APT28 hackers have been exploiting an old SNMP flaw on Cisco IOS routers to deploy a custom malware named 'Jaguar Tooth.' Custom Cisco IOS router malware Jaguar Tooth is malware injected directly into the memory of Cisco routers running older firmware versions. Once installed, the malware exfiltrates information from the router and provides unauthenticated backdoor access to the device.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
APT28 hackers have been exploiting an old SNMP flaw on Cisco IOS routers to deploy a custom malware named 'Jaguar Tooth.' Custom Cisco IOS router malware Jaguar Tooth is malware injected directly into the memory of Cisco routers running older firmware versions. Once installed, the malware exfiltrates information from the router and provides unauthenticated backdoor access to the device.
One of the NCSC's earlier advisories, dated April 2023, noted that similar attacks on Cisco routers resulted in APT28 deploying Jaguar Tooth malware, establishing backdoors for follow-on attacks.
Techniques & procedures
6 distinct techniques documented for this family, organized by ATT&CK tactic.
Reconnaissance
1 technique
Reconnaissance
Initial Access
2 techniques
Initial Access
Execution
1 technique
Execution
Persistence
1 technique
Persistence
Command and Control
1 technique
Command and Control
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware deployed by APT28 on compromised Cisco routers to establish a backdoor for follow-on attacks.
Custom, non-persistent Cisco IOS router malware that is injected into router memory, collects device information, exfiltrates it over TFTP, and enables unauthenticated backdoor access including access to existing local accounts without password verification via Telnet or physical session.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.