The UK’s National Cyber Security Centre (NCSC) has released an official advisory warning that the Russian state-backed group APT28 has been actively compromising consumer and small-business routers. The objective is to reroute internet traffic through attacker-controlled infrastructure, enabling large-scale credential theft and covert monitoring.
Who is APT28?
The NCSC states with high confidence that APT28, also known as Fancy Bear, Forest Blizzard, Sofacy, and Pawn Storm, is linked to Russia’s Main Intelligence Directorate (GRU), specifically Unit 26165 of its 85th Main Special Service Centre. The group has a well-documented history of cyber espionage operations, including involvement in the 2015 breach of the German Bundestag and a 2018 attempted intrusion targeting the Organization for the Prohibition of Chemical Weapons (OPCW).
How the Attack Works
Beginning in 2024 and continuing into 2026, APT28 has been deploying Virtual Private Servers (VPSs) configured as malicious DNS resolvers. These systems receive significant volumes of DNS traffic originating from routers that were previously compromised through exploitation of known vulnerabilities.
The attack leverages the fundamental role of DNS, which translates human-readable domain names such as “outlook.com” into IP addresses. By altering DNS settings on a compromised router, all connected devices such as laptops, smartphones, and smart TVs that are unknowingly directed to attacker-controlled servers instead of legitimate ones when accessing online services.
In one of the identified activity clusters, APT28 altered DHCP DNS configurations on compromised SOHO routers, particularly TP-Link devices, inserting attacker-controlled IP addresses. These settings were automatically propagated to devices connected to the network. DNS queries for targeted domains, such as email platforms and authentication portals, were resolved to malicious IP addresses, while all other traffic was forwarded to legitimate destinations to maintain normal functionality and avoid detection.
This selective manipulation acts as an evasion mechanism, allowing typical user activity to appear unaffected while the compromise remains hidden.
Adversary-in-the-Middle Attacks and Credential Harvesting
After routing traffic through their infrastructure, APT28 redirected users attempting to access common services, such as Outlook, to spoofed websites designed to mimic legitimate login pages. Victims unknowingly submitted valid credentials, which were then captured by the attackers. The stolen data included passwords and authentication tokens such as OAuth credentials. Subsequent unauthorized access attempts were often conducted through additional infrastructure not directly referenced in the advisory.
Investigators identified targeted domains including autodiscover-s.outlook.com, imap-mail.outlook.com, outlook.live.com, outlook.office.com, and outlook.office365.com, indicating a strong focus on email-based intelligence collection.
The Vulnerability Exploited
APT28 exploited vulnerabilities in TP-Link WR841N routers, likely leveraging CVE-2023-50224. This authentication bypass flaw, rated with a CVSS score of 6.5, allows unauthenticated attackers to extract stored credentials using specially crafted HTTP GET requests. After obtaining credentials, a second request modifies the DHCP DNS configuration, setting a malicious primary DNS while preserving the original as secondary. This maintains connectivity while silently intercepting traffic. More than 20 additional TP-Link models were also targeted, including Archer C5 and C7, WDR3500, WDR3600, WDR4300, and several MR-series LTE devices.
Two Distinct Infrastructure Clusters
Researchers identified two partially overlapping infrastructure clusters:
- The first cluster focused on directly compromising SOHO routers and altering DNS configurations.
- The second involved servers receiving DNS traffic via compromised MikroTik and TP-Link routers, forwarding requests to additional attacker-controlled systems. This second cluster also included targeted operations against a limited number of MikroTik routers in Ukraine, suggesting specific intelligence-driven objectives.
Scale and Scope
The campaign operates at significant scale. At its peak in December 2025, over 18,000 unique IP addresses across more than 120 countries were observed communicating with APT28 infrastructure. Targets included ministries of foreign affairs, law enforcement agencies, and third-party email and cloud service providers across regions such as North Africa, Central America, Southeast Asia, and Europe. Microsoft Threat Intelligence attributed the activity to APT28 and its subgroup Storm-2754, identifying over 200 affected organizations and approximately 5,000 impacted consumer devices.
US Law Enforcement Response
On April 7, 2026, the US Department of Justice and the FBI announced a court-approved operation aimed at disrupting the domestic segment of the DNS hijacking network, which spanned more than 23 states. The FBI deployed commands to compromised routers that gathered forensic data, removed malicious DNS configurations, restored legitimate ISP settings, and blocked the attackers’ method of re-entry. These actions were carried out without interrupting normal device operation or accessing user data.
Opportunistic by Design
The campaign is believed to have started as early as May 2025 on a limited scale, before expanding into widespread exploitation and DNS manipulation by August. The activity is characterized as opportunistic, with APT28 initially targeting a broad pool of victims and later focusing on high-value targets such as government officials, corporate leadership, and intelligence-linked individuals. Automated systems were used to analyze large volumes of intercepted DNS traffic, enabling selective escalation against targets deemed valuable.
What Organizations Should Do
The NCSC advisory outlines several key defensive measures. Organizations should regularly update router firmware and apply security patches, restrict exposure of management interfaces to the internet, implement multi-factor authentication for accounts at risk of credential compromise, and monitor networks for unauthorized DNS changes. Additionally, adopting a segmented or “browse-down” architecture can limit the ability of attackers to pivot from compromised edge devices into critical internal systems.
The advisory highlights that routers, often overlooked in both enterprise and home environments, represent a critical and underprotected control point. Once compromised, a single router can silently expose all devices and users within its network.