NCSC Warns of APT28 Exploiting Vulnerable Routers for DNS Hijacking Operations

According to NCSC News, state-sponsored cyber actors linked to the notorious group APT28 have launched a sophisticated wave of digital intrusions targeting vulnerable network routers. In these campaigns, the Russian threat actor systematically manipulates Domain Name System settings to execute malicious DNS hijacking operations. By seizing control of how network routing resolves web traffic, the attackers successfully position themselves to conduct covert adversary-in-the-middle attacks. This malicious positioning allows them to intercept communications between unsuspecting users and legitimate servers, creating a severe security risk for targeted entities worldwide. The fundamental goal behind these complex router exploits is the acquisition of sensitive credentials, specifically targeting user passwords and authentication tokens that grant access to secure enterprise networks and personal accounts. Once these credentials are harvested, the threat actors can leverage them to move laterally within compromised systems, escalate privileges, and maintain persistent access without immediate detection. This tactic underscores a strategic shift by advanced persistent threat groups toward exploiting peripheral network infrastructure rather than focusing solely on endpoint devices or direct server vulnerabilities. Routers, which frequently suffer from outdated firmware, weak default administrator passwords, or unpatched software flaws, present an attractive entry point for malicious actors seeking to establish a covert foothold. The implications of such operations extend far beyond simple data collection, as successful adversary-in-the-middle attacks compromise the fundamental integrity of web browsing and secure communications. Security experts emphasize that mitigating this specific threat requires a proactive approach to hardware security, including regular firmware updates, replacing legacy devices that no longer receive vendor support, and enforcing robust authentication protocols such as multi-factor methods that are less susceptible to token theft. Furthermore, organizations must monitor their network traffic anomalies to detect unauthorized DNS modifications before credential harvesting leads to more catastrophic security breaches. As cyber espionage campaigns continue to evolve in complexity and scope, the exploitation of foundational networking equipment highlights the critical need for comprehensive defensive visibility across all layers of an organization's digital footprint. The warnings issued by cybersecurity authorities serve as a vital reminder that securing the perimeter begins with hardening the foundational hardware that connects users to the wider digital world.