Russian government hackers broke into thousands of home routers to steal passwords

Security experts and government officials have raised alarms about a sophisticated hacking operation attributed to a Russian government group, which has compromised thousands of home and small business routers worldwide. This ongoing campaign is designed to redirect users' internet traffic, enabling the theft of passwords and access tokens. The notorious hacking group, often referred to as Fancy Bear or APT 28, is infamous for its high-profile cyber intrusions, including the 2016 breach of the Democratic National Committee and the 2022 attack on satellite provider Viasat. Believed to be linked to Russia's GRU intelligence agency, Fancy Bear has now shifted its focus to exploiting unpatched routers from manufacturers like MicroTik and TP-Link. These vulnerabilities were previously documented, and the U.K. National Cyber Security Centre (NCSC), alongside Lumen’s Black Lotus Labs, revealed further insights into this alarming initiative. For several years, the hackers have been able to surveil countless individuals by taking control of routers that often operate on outdated software. This leaves many users unaware of the lurking threat. The NCSC characterized these operations as opportunistic, indicating that the attackers cast a broad net initially, eventually honing in on specific targets of intelligence interest as their attack evolves. The group has manipulated router settings to reroute victims' internet requests through their own infrastructure. This method allows them to lead users to counterfeit websites they control, effectively stealing login credentials and tokens necessary for accessing victims’ online accounts without needing to bypass two-factor authentication. Black Lotus Labs reported that at least 18,000 victims across approximately 120 countries have been compromised, with targets including government agencies, law enforcement, and email service providers in regions such as North Africa, Central America, and Southeast Asia. In an effort to combat this emerging threat, Microsoft disclosed that its researchers identified over 200 organizations and around 5,000 consumer devices impacted by these hacking efforts, including several government entities in Africa. The FBI is set to announce the dismantling of multiple domains associated with this hacking scheme, with Lumen collaborating with the FBI to disrupt the botnet and take it offline. However, the FBI had not provided comments prior to the publication of this report.