APT28 Exploits Vulnerable Routers to Conduct DNS Hijacking Operations for Credential Theft

Cyber & Information WarfareCyber AttacksHacking, malware, ransomware

AggressorDefense

Summary

Russian state-sponsored APT28 exploited vulnerabilities in routers to hijack DNS settings for adversary-in-the-middle attacks, stealing credentials from internet users via malicious DNS redirection, UK NCSC reveals on 7 April 2026.

APT28, a Russian General Staff Main Intelligence Directorate cyber threat group, has been executing DNS hijacking operations by exploiting vulnerabilities in consumer-grade routers, notably multiple models of TP-Link and some MikroTik devices, to manipulate DHCP/DNS settings. These exploited routers redirect DNS queries to attacker-controlled virtual private servers functioning as malicious DNS servers, enabling adversary-in-the-middle attacks that capture authentication credentials like passwords and OAuth tokens for web and email services such as Outlook. The campaign is opportunistic, targeting numerous devices and filtering victims for intelligence value, with infrastructure clusters identified running specific SSH and DNS services. Publicly disclosed vulnerabilities such as CVE-2023-50224 were used to gain initial access and alter router settings. The UK National Cyber Security Centre published detailed mitigation advice including securing management interfaces, applying patches promptly, deploying intrusion detection, and using multi-factor authentication to reduce the impact of credential compromise. This ongoing activity represents a significant cyber espionage threat from a well-known Russian military intelligence unit targeting Western internet infrastructure.

Classification

Confidence: High

Classified as aggressor because the event describes Russian state-sponsored APT28 exploiting routers to conduct DNS hijacking and credential theft attacks. Classified as defense because the UK NCSC issues detailed mitigation guidance advising protective measures for security professionals and organizations.

Source URL

https://ncsc.gov.uk/news/apt28-exploit-routers-to-enable-dns-hijacking-operations

Open source

Provenance

Publisher: extension
Submitted: Apr 8, 2026, 20:31 UTC
Last updated: Nov 4, 2026, 08:35 UTC
Event time: Apr 7, 2026, 00:00 UTC

Published as a Defense Preparations signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "b54854f1-b28f-45b5-b489-52bdd2bfa40e",
  "url": "https://ncsc.gov.uk/news/apt28-exploit-routers-to-enable-dns-hijacking-operations",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Hacking, malware, ransomware",
  "country": "United Kingdom",
  "source_reliability": "B",
  "info_credibility": "3",
  "tags": [
    "APT28",
    "DNS hijacking",
    "Router exploitation",
    "offensive cyber operations",
    "Russian GRU",
    "Credential theft",
    "Adversary-in-the-middle",
    "TP-Link vulnerability",
    "CVE-2023-50224",
    "Malicious DNS servers"
  ],
  "nodes": [
    "Node 1: Borders"
  ],
  "countries": [
    "United Kingdom"
  ],
  "where_text": "Cyberspace",
  "headline": "APT28 Exploits Vulnerable Routers to Conduct DNS Hijacking Operations for Credential Theft",
  "description": "On or before April 7, 2026, the Russian cyber actor APT28 (also known as Fancy Bear, STRONTIUM) has been exploiting vulnerabilities in various TP-Link and MikroTik routers to overwrite DHCP/DNS settings, redirecting traffic through attacker-controlled malicious DNS servers. This DNS hijacking enables adversary-in-the-middle attacks that intercept credentials such as passwords and OAuth tokens for web and email services, increasing risks of credential theft, data manipulation, and broader network compromise. The operations are opportunistic, targeting a wide range of routers, then filtering down victims of intelligence value. The cyber infrastructure includes Virtual Private Servers operating malicious DNS servers receiving requests from compromised routers. Identified attacker IP ranges and router models exploited have been disclosed by the UK National Cyber Security Centre. Several public vulnerabilities, including CVE-2023-50224 affecting TP-Link WR841N routers, are exploited to facilitate initial access and router configuration changes. Mitigation guidance includes securing management interfaces, patching vulnerabilities, enabling multi-factor authentication, and deploying monitoring solutions.",
  "summary_short": "Russian state-sponsored APT28 exploited vulnerabilities in routers to hijack DNS settings for adversary-in-the-middle attacks, stealing credentials from internet users via malicious DNS redirection, UK NCSC reveals on 7 April 2026.",
  "summary_extended": "APT28, a Russian General Staff Main Intelligence Directorate cyber threat group, has been executing DNS hijacking operations by exploiting vulnerabilities in consumer-grade routers, notably multiple models of TP-Link and some MikroTik devices, to manipulate DHCP/DNS settings. These exploited routers redirect DNS queries to attacker-controlled virtual private servers functioning as malicious DNS servers, enabling adversary-in-the-middle attacks that capture authentication credentials like passwords and OAuth tokens for web and email services such as Outlook. The campaign is opportunistic, targeting numerous devices and filtering victims for intelligence value, with infrastructure clusters identified running specific SSH and DNS services. Publicly disclosed vulnerabilities such as CVE-2023-50224 were used to gain initial access and alter router settings. The UK National Cyber Security Centre published detailed mitigation advice including securing management interfaces, applying patches promptly, deploying intrusion detection, and using multi-factor authentication to reduce the impact of credential compromise. This ongoing activity represents a significant cyber espionage threat from a well-known Russian military intelligence unit targeting Western internet infrastructure.",
  "actor_primary": "APT28",
  "target_primary": null,
  "location_text": "United Kingdom",
  "location_region": null,
  "location_coordinates_lat": null,
  "location_coordinates_lon": null,
  "location_precision": "Unknown",
  "is_aggressor_signal": true,
  "signal_type": "DEFENSE_PREP_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "Classified as aggressor because the event describes Russian state-sponsored APT28 exploiting routers to conduct DNS hijacking and credential theft attacks. Classified as defense because the UK NCSC issues detailed mitigation guidance advising protective measures for security professionals and organizations.",
  "event_time_utc": "2026-04-07T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "exact",
  "created_at": "2026-04-08T20:31:00.050Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "unknown",
  "time_precision_band": "exact",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "independent_sources"
}

Public assessmentReliability: StrongSeverity: SignificantAttribution: HighIndependence confirmedTime: ExactLocation: Unknown

Source reliability

Info credibility

Event time

Apr 7, 2026, 00:00 UTC

Event time confidence

exact

Location

United Kingdom

Primary actor

APT28

Country

United Kingdom

Countries

United Kingdom

Tags

APT28, DNS hijacking, Router exploitation, offensive cyber operations, Russian GRU, Credential theft, Adversary-in-the-middle, TP-Link vulnerability, CVE-2023-50224, Malicious DNS servers

Nodes

Node 1: Borders

Loading signal...

{ "id": "b54854f1-b28f-45b5-b489-52bdd2bfa40e", "url": "https://ncsc.gov.uk/news/apt28-exploit-routers-to-enable-dns-hijacking-operations", "source": "extension", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Cyber Attacks", "incident_type": "Hacking, malware, ransomware", "country": "United Kingdom", "source_reliability": "B", "info_credibility": "3", "tags": [ "APT28", "DNS hijacking", "Router exploitation", "offensive cyber operations", "Russian GRU", "Credential theft", "Adversary-in-the-middle", "TP-Link vulnerability", "CVE-2023-50224", "Malicious DNS servers" ], "nodes": [ "Node 1: Borders" ], "countries": [ "United Kingdom" ], "where_text": "Cyberspace", "headline": "APT28 Exploits Vulnerable Routers to Conduct DNS Hijacking Operations for Credential Theft", "description": "On or before April 7, 2026, the Russian cyber actor APT28 (also known as Fancy Bear, STRONTIUM) has been exploiting vulnerabilities in various TP-Link and MikroTik routers to overwrite DHCP/DNS settings, redirecting traffic through attacker-controlled malicious DNS servers. This DNS hijacking enables adversary-in-the-middle attacks that intercept credentials such as passwords and OAuth tokens for web and email services, increasing risks of credential theft, data manipulation, and broader network compromise. The operations are opportunistic, targeting a wide range of routers, then filtering down victims of intelligence value. The cyber infrastructure includes Virtual Private Servers operating malicious DNS servers receiving requests from compromised routers. Identified attacker IP ranges and router models exploited have been disclosed by the UK National Cyber Security Centre. Several public vulnerabilities, including CVE-2023-50224 affecting TP-Link WR841N routers, are exploited to facilitate initial access and router configuration changes. Mitigation guidance includes securing management interfaces, patching vulnerabilities, enabling multi-factor authentication, and deploying monitoring solutions.", "summary_short": "Russian state-sponsored APT28 exploited vulnerabilities in routers to hijack DNS settings for adversary-in-the-middle attacks, stealing credentials from internet users via malicious DNS redirection, UK NCSC reveals on 7 April 2026.", "summary_extended": "APT28, a Russian General Staff Main Intelligence Directorate cyber threat group, has been executing DNS hijacking operations by exploiting vulnerabilities in consumer-grade routers, notably multiple models of TP-Link and some MikroTik devices, to manipulate DHCP/DNS settings. These exploited routers redirect DNS queries to attacker-controlled virtual private servers functioning as malicious DNS servers, enabling adversary-in-the-middle attacks that capture authentication credentials like passwords and OAuth tokens for web and email services such as Outlook. The campaign is opportunistic, targeting numerous devices and filtering victims for intelligence value, with infrastructure clusters identified running specific SSH and DNS services. Publicly disclosed vulnerabilities such as CVE-2023-50224 were used to gain initial access and alter router settings. The UK National Cyber Security Centre published detailed mitigation advice including securing management interfaces, applying patches promptly, deploying intrusion detection, and using multi-factor authentication to reduce the impact of credential compromise. This ongoing activity represents a significant cyber espionage threat from a well-known Russian military intelligence unit targeting Western internet infrastructure.", "actor_primary": "APT28", "target_primary": null, "location_text": "United Kingdom", "location_region": null, "location_coordinates_lat": null, "location_coordinates_lon": null, "location_precision": "Unknown", "is_aggressor_signal": true, "signal_type": "DEFENSE_PREP_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "Classified as aggressor because the event describes Russian state-sponsored APT28 exploiting routers to conduct DNS hijacking and credential theft attacks. Classified as defense because the UK NCSC issues detailed mitigation guidance advising protective measures for security professionals and organizations.", "event_time_utc": "2026-04-07T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "exact", "created_at": "2026-04-08T20:31:00.050Z", "updated_at": "2026-11-04T08:35:32.139Z", "reliability_band": "strong", "location_precision_band": "unknown", "time_precision_band": "exact", "severity_band": "significant", "attribution_confidence_band": "high", "attribution_basis": "independent_sources" }