Home / Technology / Russian Hackers Hijack Global Routers
Russian Hackers Hijack Global Routers
7 Apr
Summary
- Russian hackers exploited unpatched routers, compromising thousands worldwide.
- The campaign aimed to steal passwords and access tokens from victims.
- The FBI and a coalition disrupted the botnet, taking it offline.
A sophisticated cyber campaign orchestrated by Russian government hackers, known as Fancy Bear (APT 28), has compromised thousands of routers worldwide. These actors exploited unpatched vulnerabilities in devices from manufacturers like MicroTik and TP-Link. The operation, ongoing for several years, aimed to redirect internet traffic, surreptitiously capture user credentials, and gain unauthorized access to online accounts.
Researchers and government agencies, including the U.K.'s NCSC and Lumen's Black Lotus Labs, revealed details of the campaign. Fancy Bear's tactics involved modifying router settings to route victim requests through hacker-controlled infrastructure, leading to spoofed websites. Black Lotus Labs reported at least 18,000 victims across approximately 120 countries.
Microsoft's analysis identified over 200 organizations and 5,000 consumer devices affected, including government entities in Africa. Law enforcement efforts, spearheaded by the FBI in coalition with other entities, have successfully disrupted the botnet, bringing the widespread operation offline.
