Russia’s military hacks thousands of consumer routers to steal credentials

The Russian military has intensified its cyber operations, employing a widespread hacking initiative that compromises home and small office routers, according to recent findings from cybersecurity experts. Researchers have estimated that between 18,000 and 40,000 consumer routers, primarily from manufacturers MikroTik and TP-Link, have been exploited across 120 countries, integrating them into the infrastructure of APT28, a notorious hacking group affiliated with Russia's military intelligence agency, the GRU. APT28, also known by various aliases such as Pawn Storm and Tsar Team, has a long history of conducting high-profile cyberattacks targeting government entities globally for over two decades. The group has leveraged a small number of compromised routers to serve as proxies, enabling access to a far greater number of routers owned by foreign ministries, law enforcement, and other government agencies. In this latest campaign, the hackers manipulated the DNS settings of targeted websites, affecting services like Microsoft 365. Researchers from Lumen Technologies’ Black Lotus Labs noted, "APT28 is known for its innovative use of advanced tools, including a large language model referred to as ‘LAMEHUG’, alongside traditional methods, demonstrating their adaptability in evading cybersecurity defenses." The attackers capitalized on older router models that lacked necessary security updates, allowing them to alter DNS configurations for specific domains. This manipulation facilitated the redirection of connections from infected devices through malicious servers before they reached their intended targets, furthering the group’s espionage objectives.