APT28 GRU Router Hijacking Turns Home Wi-Fi Into Enterprise Attack Surface

NCSC dates the activity to "Since 2024 and into 2026," during which APT28 configured virtual private servers to operate as malicious DNS servers. Those servers received high volumes of DNS requests originating from routers the actor had already exploited. Investigators sorted the infrastructure into two banner-pattern clusters.

In the first cluster, the DHCP DNS server settings of compromised SOHO routers were modified to include actor-owned IP addresses. Those settings were then inherited automatically by every downstream device on the network, including laptops and phones. This is the mechanism that makes the technique effective: nothing is installed on the endpoint, and the endpoint's own configuration is never touched. It simply asks the router where to send DNS queries and is told to send them to Russian military intelligence.

The resolvers did not poison everything. NCSC states that lookups for domain names containing key terms associated with particular services, often email applications or login pages, were resolved to further actor-owned IP addresses, while DNS requests not matching the actor's targeting criteria were resolved to the legitimate IP addresses for the requested services. Selective poisoning of this kind is a deliberate evasion choice. A household whose banking, streaming and social media all work normally has no reason to suspect its router, and a helpdesk ticket is never raised.

The redirected connections were then subjected to adversary-in-the-middle attacks. NCSC records that this activity could be conducted against both user browser sessions and desktop applications, and that harvested authentication material could include both passwords and OAuth or similar authentication tokens. The FBI describes the interception as effective against encrypted traffic where users navigate through a certificate error warning, and Microsoft states that its infrastructure presented an invalid TLS certificate that victims had to click past.

Follow-on logins with the stolen material, NCSC warns, may originate from infrastructure not listed in the advisory.

NCSC assesses the operation as opportunistic, with the actor gaining visibility of a large pool of candidate target users and then filtering down at each stage of the exploitation chain to triage for victims of likely intelligence value. This is bulk collection with a funnel attached, not targeted intrusion.

The infrastructure did not survive disclosure untouched. The FBI states that the Department of Justice and the FBI recently disrupted a GRU network of compromised small office home office routers used to facilitate malicious DNS hijacking operations. The PSA gives neither the date nor the scope of that disruption, and neither advisory says what proportion of the 182 published addresses it removed, so defenders should treat the indicator list as live rather than historical.

The FBI credits Black Lotus Labs at Lumen and Microsoft Threat Intelligence with technical contributions to the announcement.

NCSC names the TP-Link WR841N as one of the router models exploited, likely using CVE-2023-50224. Per the National Vulnerability Database, that CVE is a TP-Link TL-WR841N dropbearpwd improper authentication information disclosure flaw. The specific flaw exists in the httpd service listening on TCP port 80 by default; authentication is not required, and an attacker can leverage it to disclose stored credentials.

It carries CVSS v3.0 base score 6.5 as scored by the Zero Day Initiative acting as CNA, vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, and is classified CWE-290, Authentication Bypass by Spoofing. It was published on May 2, 2024 and added to the CISA Known Exploited Vulnerabilities catalog on September 3, 2025 with a remediation due date of September 24, 2025.

The chain NCSC describes is two requests long. The first crafted HTTP GET request retrieves the router's stored administrative credentials. The second, now authenticated, alters the DHCP DNS settings. NCSC notes the request typically set the router's primary DNS server to a malicious IP address while setting the secondary DNS server to the original primary resolver's address, which preserves working name resolution as a fallback and reduces the chance a user notices a problem.

In some cases both primary and secondary were set to malicious addresses, which NCSC reads as evidence a router had been exploited more than once.

A second cluster of infrastructure received DNS requests forwarded through likely compromised MikroTik and TP-Link devices onward to further actor-owned servers, and was also used for interactive operations against a small number of MikroTik routers, often located in Ukraine, that NCSC assesses were likely of intelligence value.

NCSC assesses that APT28 is almost certainly the Russian General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Centre (GTsSS) Military Intelligence Unit 26165, and describes it as a highly skilled threat actor. The word "almost certainly" is the assessment NCSC published; it should not be restated as a confirmed fact.

The aliases NCSC lists are Forest Blizzard, Fancy Bear, STRONTIUM, the Sednit Gang and Sofacy. The FBI uses APT28, Fancy Bear and Forest Blizzard, and identifies the unit as the GRU 85th Main Special Service Center. Microsoft tracks the actor as Forest Blizzard and attributes this specific activity to a subgroup it tracks as Storm-2754.

NCSC records prior attributions to the same actor, including cyber attacks against the German parliament in 2015 involving data theft and disruption of email accounts belonging to German Members of Parliament and the Vice Chancellor, and an attempted attack against the Organisation for the Prohibition of Chemical Weapons in April 2018 aimed at disrupting independent analysis of chemical weapons used in the UK. NCSC also cross-references its earlier advisory on APT28 exploiting a known vulnerability to conduct reconnaissance and deploy malware on Cisco routers, which places this campaign in a documented multi-year pattern of edge-device targeting rather than treating it as a novel departure.

Paul Chichester, NCSC Director of Operations, said: "This activity demonstrates how exploited vulnerabilities in widely used network devices can be leveraged by sophisticated hostile actors. We strongly encourage organisations and network defenders to familiarise themselves with the techniques described in the advisory and to follow the mitigation advice."

• Account passwords for web and email services, captured through adversary-in-the-middle interception of browser sessions and desktop mail applications.
• OAuth or similar authentication tokens. These matter more than the passwords. A stolen token can be replayed to reach a mailbox without triggering a password prompt and, depending on configuration, without a second factor challenge, because the token already represents a completed authentication.
• Email content and web browsing information normally protected by SSL and TLS, per the FBI.
• Microsoft 365 and Outlook Web Access session material, based on the five Outlook domains NCSC lists as targeted for redirection.
• Router administrative credentials, disclosed by CVE-2023-50224 before any DNS change was made.
• DNS query metadata for every device behind a compromised router. Even where no interception followed, the actor-controlled resolver saw the full lookup history of the household, which is a standing intelligence collection capability against the individual.