The Russian state-sponsored cyber espionage group known as Static Tundra, linked to Russian FSB Center 16, has been actively exploiting a critical vulnerability (CVE-2018-0171) in Cisco IOS and Cisco IOS XE software. This flaw, found in the Smart Install feature, allows unauthenticated attackers to trigger denial-of-service (DoS) conditions or execute arbitrary code on unpatched devices. The group targets organizations across telecommunications, higher education, manufacturing, and critical infrastructure sectors globally, with heightened focus on Ukraine and its allies due to strategic interests following the Russia-Ukraine war. Static Tundra, also known as Berserk Bear and Dragonfly, has been operational for over a decade, demonstrating a capability to maintain long-term access to compromised networks without detection. They utilize services like Shodan and Censys to identify vulnerable systems and employ tools such as SYNful Knock to establish persistence. Their operations involve collecting configuration files from thousands of networking devices and modifying them to facilitate unauthorized access. The FBI and Cisco Talos have issued warnings urging administrators to patch or disable Smart Install to prevent exploitation. Despite the focus on Russian actors, other state-sponsored groups are likely conducting similar campaigns exploiting CVE-2018-0171. CTIX analysts will continue to report on threat actors and their attack campaigns.