Russian APT28 Hijacks Routers to Steal Government Passwords

The UK's National Cyber Security Centre published a detailed advisory revealing how Russian state-sponsored hackers are compromising routers to intercept internet traffic and steal passwords from government and critical infrastructure organizations. The NCSC advisory details how APT28, linked to Russia's GRU military intelligence unit 26165, overwrites DHCP and DNS settings to redirect traffic through attacker-controlled servers.

The technique enables adversary-in-the-middle attacks that harvest passwords, OAuth tokens, and other authentication credentials. The campaign targets vulnerable routers across government networks and critical infrastructure, allowing long-term persistent access to sensitive communications.

Organizations should verify router configurations, monitor for unexpected DNS changes, and enforce multi-factor authentication to mitigate credential theft risks from this campaign.