US Disrupts Russian Espionage Operation Involving Hacked Routers and DNS Hijacking

The APT28 threat group exploited vulnerabilities in TP-Link and MikroTik routers to perform adversary-in-the-middle (AitM) attacks involving DNS hijacking. This espionage operation was disrupted by US authorities. The attack leveraged compromised routers to intercept and manipulate network traffic. No specific affected versions or patches are detailed in the available information. There is no indication of known exploits currently active in the wild. The overall severity of this threat is assessed as medium based on the described impact.

• securityweek.com/us-disrupts-russian-espionage-operation-involving-hacked-routers-and-dns-hijacking/ (opens in a new tab)