APT28 Exploits Cisco Router Vulnerabilities for Long-Term Espionage

The UK National Cyber Security Centre and US NSA issued a joint advisory warning that APT28 has been exploiting CVE-2026-20145 and older Cisco IOS vulnerabilities to install GRU-developed malware on routers used by European government agencies. The malware, named Jaguar Tooth, enables undetected SNMP-based data exfiltration. Campaign has been active for at least 6 months.