Russia07 April, 20261 min read
Russian Fancy Bear Hackers Hijack Thousands of Home Routers Globally
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Thousands of home routers worldwide hijacked to steal credentials and manipulate traffic. APT28 (Fancy Bear) linked to GRU, orchestrated these router-hijack campaigns.
Scope and Methodology
Russian government hackers hijacked thousands of home and small-office routers worldwide to redirect traffic and steal credentials. The campaign targeted unpatched MikroTik and TP-Link devices using known vulnerabilities and default credentials. The U.K.'s NCSC confirmed spying had been carried out since 2024.
Microsoft identified at least 18,000 networks compromised globally. Victims continued using their networks normally while attackers invisibly proxied traffic through Russian-controlled infrastructure.
Credential Theft and Espionage
Attackers redirected victim internet requests to spoof websites under their control, harvesting passwords and tokens. The infiltration did not require installing malware on endpoints. Discovered victims included government agencies and law enforcement.
Government Response
The DOJ, FBI, NSA, GCHQ, and international partners executed coordinated operations to neutralize the botnet. Court-authorized operations remotely deleted malware and blocked re-access pathways. The campaign elevated consumer-grade hardware to a front-line battlefield of cyber espionage.