APT28 Exploits Routers for DNS Hijacking Attacks

Detected April 7th, 2026

Summary

The NCSC published an advisory exposing how Russian state cyber group APT28 compromised vulnerable internet routers to conduct DNS hijacking operations, enabling traffic interception and credential harvesting. The advisory provides mitigation guidance including protecting management interfaces, maintaining updated devices, and implementing two-step verification.

View original document View source feed page

What changed

The NCSC revealed that APT28 (linked to Russia's GRU Military Unit 26165) exploited vulnerable edge devices to hijack DNS traffic, covertly redirecting users to malicious servers to harvest passwords and access tokens from web and email services. The activity is described as opportunistic, with actors casting a wide net before narrowing to targets of intelligence interest.

Organisations and network defenders should review the advisory and implement mitigation measures: protect management interfaces of systems from unauthorized access, ensure devices and software are maintained and kept up-to-date, and enable two-step verification on management interfaces. While no compliance deadline is specified, this represents actionable defensive guidance from the UK's lead cybersecurity authority.

What to do next

Review the NCSC advisory on APT28 DNS hijacking techniques and share with network defenders
Audit router and edge device management interfaces to ensure they are not exposed to the internet
Verify all network devices and firmware are updated to latest versions and enable multi-factor authentication on management interfaces

Source document (simplified)

News Download & print article PDF

UK exposes Russian military intelligence hijacking vulnerable routers for cyber attacks

New advisory warns cyber threat group APT28 have exploited vulnerable edge devices to support malicious operations.

iStock.com/just_super The National Cyber Security Centre (NCSC) – a part of GCHQ – has published a new advisory revealing how Russian cyber actors have compromised commonly used routers, allowing them to covertly reroute users’ internet traffic through malicious servers under their control.

The new advisory warns that Russian state cyber group APT28 has exploited vulnerable internet routers to enable Domain Name System (DNS) hijacking operations, giving the attackers the ability to intercept traffic and harvest login credentials, including passwords and access tokens, from personal web and email services.

DNS is what allows individuals to reach websites by typing familiar addresses, instead of associated IP addresses. In a DNS hijacking attack, actors interfere with this process to covertly send users to malicious websites designed to steal login details or other sensitive information.

The advisory also notes that the activity is likely opportunistic in nature, with the actor casting a wide net to reach many potential victims, before narrowing in on targets of intelligence interest as the attack develops.

APT28 has previously been linked by the UK to Russia’s GRU 85th Main Special Service Centre (GTsSS), Military Unit 26165.

Paul Chichester, NCSC Director of Operations, said:

This activity demonstrates how exploited vulnerabilities in widely used network devices can be leveraged by sophisticated hostile actors.

We strongly encourage organisations and network defenders to familiarise themselves with the techniques described in the advisory and to follow the mitigation advice.

The NCSC will continue to expose Russian malicious cyber activity and provide practical guidance to help protect UK networks.
Organisations and network defenders are encouraged to follow the mitigation advice to effectively protect against DNS hijacking attacks, including protecting the management interfaces of systems, ensuring devices and software are maintained and up-to-date, and setting up two-step verification.

The NCSC has previously called out APT 28 / Unit 26165, also known in open source as Fancy Bear, Forest Blizzard, the Sednit Gang and Sofacy, for deploying a sophisticated malware dubbed AUTHENTIC ANTICS and targeting western logistics entities and technology companies.

Download & print article PDF Share Share Facebook LinkedIn X Copy Link