What is APT28 and why are they targeting routers?

APT28, tied to Russia's GRU, hijacks routers via DNS tweaks to steal credentials opportunistically, focusing on high-value intel targets like Ukraine ops.

How do I protect my TP-Link or MikroTik router from APT28?

Patch to latest firmware, enable MFA, use strong unique passwords, and consider browse-down architecture or router replacement if end-of-life.

Is APT28's router campaign linked to bigger attacks?

Yes, stolen creds enable follow-on ops; NCSC warns logins may hit unlisted infra, echoing past hits like German parliament hacks.

🌐 Nation-State Threats

APT28's Router Trap: How Russian Hackers Are Siphoning Your Secrets Through Everyday WiFi Gear

Imagine your trusty router, that unassuming box in the corner, quietly handing your login details to GRU spies. Russia's APT28 just turned SOHO devices into credential vacuums, and the UK's NCSC is sounding the alarm.

Threat Digest Apr 07, 2026 4 min read

Digital illustration of a router with Russian bear claw marks redirecting data streams to spy servers

⚡ Key Takeaways

APT28 exploits TP-Link and MikroTik routers via known CVEs to hijack DNS and steal credentials through AitM attacks. 𝕏
NCSC attributes campaigns to Russia's GRU Unit 26165; opportunistic scanning leads to targeted intel grabs. 𝕏
Mitigate with patches, MFA, and network segmentation—your SOHO router is prime prey. 𝕏

Published by

Threat Digest

Threat intelligence. Zero noise.

#APT28 #DNS hijacking #DNS theft #Fancy Bear #NCSC advisory #credential theft #router hijacking

Worth sharing?

Get the best Cybersecurity stories of the week in your inbox — no noise, no spam.

Originally reported by InfoSecurity Magazine

⚡ Key Takeaways

The 60-Second TL;DR

Threat Digest

Share this article

Worth sharing?

Related Stories

APT28's FrostArmada: How Russian Spies Hijacked 18,000 Routers for Stealthy Global Espionage

FrostArmada's Fall: How Cops Crushed Russia's Router Spy Network Targeting Microsoft Logins

GRU's Simple Router Trick Nabbed Microsoft Tokens from 18,000 Networks

Venom Stealer: The Malware That Turns One-Time Heists into Endless Data Streams

Stay in the loop