Full Report
Russian state-linked threat actor APT28 is exploiting vulnerable routers to manipulate Domain Name System (DNS) settings, enabling large-scale... The post UK NCSC says APT28 exploits routers for DNS hijacking, enabling large-scale traffic interception appeared first on Industrial Cyber.
Analysis Summary
# Threat Actor: APT28
## Attribution & Identity
* **Identification:** Russian General Staff Main Intelligence Directorate (GRU), 85th Main Special Service Centre (GTsSS), Military Intelligence Unit 26165.
* **Aliases:** Forest Blizzard, Fancy Bear, STRONTIUM, Sednit Gang, Sofacy.
* **Actor Type:** Russian state-linked/Nation-state.
## Activity Summary
Between 2024 and 2026, APT28 has been observed exploiting vulnerabilities in Small Office/Home Office (SOHO) routers to perform large-scale DNS hijacking. The actor modifies DHCP and DNS settings on compromised routers to redirect traffic through attacker-controlled Virtual Private Servers (VPS). This infrastructure allows the group to conduct Adversary-in-the-Middle (AitM) operations to intercept email and web traffic, specifically targeting authentication credentials and session tokens.
## Tactics, Techniques & Procedures
* **Exploitation of Edge Devices:** Scanning for and exploiting public vulnerabilities in SOHO routers.
* **DNS Hijacking/Poisoning:** Modifying router configurations (DNS/DHCP settings) to point to malicious DNS servers.
* **Adversary-in-the-Middle (AitM):** Intercepting traffic to harvest credentials and authentication tokens.
* **Conditional Redirection:** Malicious DNS servers selectively resolve domains associated with email and login pages to attacker IPs, while resolving non-target requests to legitimate IPs to avoid detection.
* **Infrastructure Obsfucation:** Use of Virtual Private Servers (VPS) to host malicious DNS servers and intercept traffic.
## Targeting
* **Sectors:** Critical infrastructure, Government, Logistics, Maritime Transport, and Defense.
* **Geography:** United Kingdom, Germany, Poland, Czech Republic, and United States.
* **Victims:**
* **Historical:** German Parliament (2015), Organisation for the Prohibition of Chemical Weapons (2018).
* **Recent:** Logistics and tech firms, European maritime transport agencies, and users of SOHO routers for remote access.
## Tools & Infrastructure
* **Infrastructure:**
* Malicious DNS Servers hosted on Virtual Private Servers (VPS).
* **Defanged IPs:** The article refers to "actor-owned IP addresses" and "maligned DNS servers" (specific IPs not listed in text, but reported as being organized in two banner pattern clusters).
* **Malware/Exploits:** Exploitation of public vulnerabilities in router firmware and Outlook flaws (historical).
## Implications
This campaign represents a move toward scalable, persistent espionage through network-level manipulation. By compromising the router rather than the endpoint, APT28 bypasses many host-based security controls. The ability to intercept traffic from all downstream devices (phones, laptops) allows for high-volume credential harvesting and facilitates follow-on operations, such as deep-network compromise or the disruption of critical organizational communication.
## Mitigations
* **Router Security:** Regularly update SOHO router firmware to patch public vulnerabilities.
* **Device Hardening:** Disable remote management interfaces on routers and change default administrative credentials.
* **DNS Protection:** Configure devices to use encrypted DNS protocols (DNS over HTTPS/TLS) and monitor for unauthorized changes to DHCP/DNS settings.
* **Multi-Factor Authentication (MFA):** Implement robust MFA (preferably hardware-backed or FIDO2) to mitigate the impact of harvested credentials.
* **Traffic Monitoring:** Monitor for unusual DNS query patterns or high volumes of requests directed toward unverified VPS infrastructure.