Home / Technology / Russian Spies Hijacked Home Routers for Espionage
Russian Spies Hijacked Home Routers for Espionage
1 Jun
Summary
- Russian intelligence used home routers for widespread espionage.
- Thousands of devices in 23 US states were compromised.
- Outdated routers with unpatched firmware were primarily targeted.
A sophisticated cyberespionage operation, linked to Russian military intelligence group APT28, has been actively compromising thousands of Small Office/Home Office (SOHO) routers. This ongoing attack, identified as a Domain Name System (DNS) hijacking operation, allows the actors to intercept unencrypted internet traffic and gather sensitive information.
Federal agents disrupted the operation in April, but the exploitation of vulnerable routers continues. The attackers specifically targeted devices with unpatched firmware and unchanged default passwords, impacting over 200 organizations and an estimated 5,000 consumer devices across 23 US states. The FBI has noted this campaign has been active since at least 2024.
The primary targets were TP-Link routers, many of which have reached their End of Service and Life status. While some security updates have been released for legacy models, TP-Link strongly advises users to upgrade to newer devices that still receive security patches. Experts emphasize the critical need for basic router hygiene to protect against such widespread threats.
