Russian Hackers Hijack UK Routers

Russian state cyber group APT28, identified as a unit of Russian military intelligence, has been actively exploiting vulnerabilities in widely used internet routers across the UK. The National Cyber Security Centre (NCSC) issued a warning on Tuesday regarding these activities. The hackers are covertly rerouting users' internet traffic through malicious servers under their control. This allows them to conduct domain name system (DNS) hijacking operations.

This sophisticated cyber espionage technique enables attackers to intercept traffic and steal sensitive data, including passwords and access tokens from personal web and email services. The NCSC specifically named TP-Link and MikroTik as companies whose routers are vulnerable to this method.

To combat this threat, the NCSC urges both companies and individuals to implement protective measures. These recommended actions include applying crucial security updates promptly and conducting regular antivirus scans. The NCSC highlighted that such exploits demonstrate how compromised network devices can be leveraged by advanced cyber adversaries, emphasizing the need for vigilance.

The NCSC assesses this activity as likely opportunistic, with hackers casting a wide net before narrowing their focus on targets of intelligence interest. APT28, also known by aliases such as Forest Blizzard and Fancy Bear, has a history of involvement in significant cyber attacks globally.