APT28 Router DNS Hijacking for Adversary-in-the-Middle Credential Theft
APT28 Router DNS Hijacking for Adversary-in-the-Middle (TL-2026-0330), also tracked as APT28 DNS Hijacking Campaign, is a high-severity advanced persistent threat campaign, first published 2026-04-07. It is attributed to APT28 (Russia) with high confidence, affects Ubiquiti EdgeRouter, references 1 CVE (CVE-2017-6742), maps to 19 MITRE ATT&CK techniques (T1016, T1021, T1070), and is covered by 9 detection rules and 24 indicators of compromise.
Key facts for TL-2026-0330
- Threat ID
- TL-2026-0330
- Also known as
- APT28 DNS Hijacking Campaign, GRU Router Exploitation 2026
- Severity
- HIGH
- Status
- MONITORING
- Category
- APT
- First published
- 2026-04-07
- Last reviewed
- 2026-04-07
- Attribution
- APT28
- Attribution confidence
- HIGH
- Nation-state nexus
- Russia
- Motivation
- ESPIONAGE
- Target sectors
- government, military, defense, energy, critical-infrastructure, transportation, logistics, diplomatic, think-tanks, technology, nuclear
- Target regions
- Europe, North America, Eastern Europe, United Kingdom, Ukraine, Poland, Czech Republic, Romania, Slovakia, Slovenia, Turkey, North Macedonia
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in APT28 Router DNS Hijacking for Adversary-in-the-Middle
Malware and tooling: AUTHENTIC ANTICS, BEARDSHELL, GooseEgg, Jaguar Tooth, MooBot, PRISMEX, Covenant, Responder - S0174
Russian GRU-linked APT28 (Fancy Bear / Forest Blizzard / Pawn Storm) is exploiting vulnerable internet-facing SOHO routers to hijack DNS resolution, enabling adversary-in-the-middle (AiTM) interception of user traffic to harvest login credentials, passwords, and OAuth access tokens from personal web and email services. NCSC UK advisory published 2026-04-07 warns of opportunistic wide-net targeting that narrows to intelligence-value victims.
How APT28 Router DNS Hijacking for Adversary-in-the-Middle works
On April 7, 2026, the UK National Cyber Security Centre (NCSC) published an advisory exposing an active campaign by Russian state cyber group APT28 that exploits vulnerable internet routers to conduct DNS hijacking operations. APT28 — attributed to Russia's GRU 85th Main Special Service Centre (GTsSS), Military Unit 26165 — compromises commonly used SOHO routers and reconfigures their DNS settings to covertly reroute victim internet traffic through attacker-controlled servers.
The DNS hijacking technique is a form of adversary-in-the-middle (AiTM) attack. By modifying DNS resolution on compromised routers, APT28 redirects users attempting to reach legitimate web and email services to malicious intermediary servers. These servers present convincing credential harvesting pages or transparently proxy traffic while extracting authentication material — including passwords, session cookies, and OAuth 2.0 access tokens — before forwarding victims to the real service. This makes the compromise invisible to end users.
The campaign follows an opportunistic targeting model: APT28 initially casts a wide net by compromising large numbers of vulnerable routers, then narrows focus to victims of intelligence interest as the operation develops. This pattern is consistent with APT28's documented tradecraft of bulk infrastructure compromise followed by selective exploitation.
This campaign builds on APT28's extensive history of router exploitation. In February 2024, the FBI disrupted the Moobot botnet — a network of hundreds of compromised Ubiquiti EdgeRouters that APT28 had been using since at least 2022 to harvest credentials, proxy network traffic, and host spearphishing landing pages. The actors accessed EdgeRouters using default credentials and deployed Trojanized OpenSSH server processes, Python credential-harvesting scripts, and custom routing rules to redirect phishing traffic. Despite the FBI takedown, APT28 has continued to target router infrastructure.
APT28's router exploitation is also linked to their exploitation of CVE-2017-6742, an SNMP remote code execution vulnerability in Cisco IOS and IOS XE routers. The NCSC and CISA jointly documented APT28 deploying the Jaguar Tooth malware to Cisco routers via this vulnerability to collect device and network information and establish backdoor access.
The DNS hijacking campaign connects to APT28's broader 2026 operational tempo. The group has been conducting parallel campaigns including: the PRISMEX malware deployment targeting NATO logistics and Eastern European government entities via CVE-2026-21509 and CVE-2026-21513; the AUTHENTIC ANTICS credential theft malware that embeds within Outlook processes to intercept Microsoft 365 credentials and OAuth tokens; credential harvesting campaigns targeting Turkish energy, European think tanks, and organizations across North Macedonia and Uzbekistan; and the BEARDSHELL/COVENANT malware campaign targeting Ukrainian military infrastructure.
The DNS hijacking operation is particularly dangerous because it operates at the network infrastructure layer, affecting all devices using the compromised router for DNS resolution. Individual endpoint security controls may not detect the compromise since traffic appears to flow normally from the endpoint perspective. Organizations and individuals relying on compromised routers for DNS resolution are exposed to credential theft across all web services accessed through that connection.
Mitigation requires securing router management interfaces, applying firmware patches, changing default credentials, implementing DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) on endpoints, deploying multi-factor authentication on all critical accounts, and monitoring for DNS configuration changes on network devices.
MITRE ATT&CK techniques used in TL-2026-0330
discovery
T1016 System Network Configuration Discovery
lateral-movement
defense-evasion
command-and-control
T1090 Proxy; T1102 Web Service
credential-access
T1110 Brute Force; T1187 Forced Authentication; T1528 Steal Application Access Token; T1557 Adversary-in-the-Middle
collection
initial-access
T1190 Exploit Public-Facing Application; T1566 Phishing
impact
T1498 Network Denial of Service
persistence
T1505 Server Software Component
privilege-escalation
T1546 Event Triggered Execution
exfiltration
T1567 Exfiltration Over Web Service
resource-development
T1584 Compromise Infrastructure; T1588 Obtain Capabilities
defense-impairment
Affected products and versions in APT28 Router DNS Hijacking for Adversary-in-the-Middle
- Ubiquiti — EdgeRouter
Vulnerable versions: All versions with default credentials
Fixed in: Latest EdgeOS with hardened configuration - Cisco — IOS / IOS XE Routers
Vulnerable versions: IOS versions vulnerable to CVE-2017-6742
Fixed in: Patched IOS versions per Cisco advisory - Multiple — SOHO Routers (various consumer brands)
Vulnerable versions: Devices with default credentials or unpatched firmware
Fixed in: Devices with updated firmware and changed credentials
Remediation for APT28 Router DNS Hijacking for Adversary-in-the-Middle
Patches
- Apply latest firmware updates to all SOHO routers
- Patch Cisco IOS/IOS XE routers against CVE-2017-6742 (SNMP RCE)
- Apply Ubiquiti EdgeOS updates to latest stable release
- Patch Microsoft Office against CVE-2026-21509 (related APT28 campaign)
- Patch Windows against CVE-2026-21513 (related APT28 campaign)
Immediate actions
- Audit all internet-facing router DNS configurations for unauthorized changes
- Change default credentials on all SOHO routers and network devices
- Restrict router management interfaces to trusted networks only
- Enable multi-factor authentication on all critical web and email accounts
- Block known APT28 infrastructure at perimeter firewalls
- Check Ubiquiti EdgeRouters for /usr/lib/libu.a/ directory indicating compromise
- Search bash histories on EdgeRouters for downloads from packinstall.kozow.com
Workarounds
- Configure endpoints to use trusted external DNS resolvers (e.g., 1.1.1.1, 8.8.8.8) with DoH/DoT instead of router-provided DNS
- Disable remote management on SOHO routers
- Disable SNMP on Cisco routers or restrict to SNMPv3 with strong authentication
- Segment IoT and SOHO devices from critical business networks
Longer-term hardening
- Deploy DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) on all endpoints to bypass router DNS manipulation
- Implement DNSSEC validation on authoritative DNS infrastructure
- Deploy network monitoring for DNS configuration changes on routers
- Establish baseline DNS resolution behavior and alert on deviations
- Replace end-of-life routers that no longer receive firmware updates
- Implement certificate pinning for critical internal services
- Deploy EDR with behavioral detection for credential theft patterns
CVEs associated with APT28 Router DNS Hijacking for Adversary-in-the-Middle
Weaknesses (CWE) in APT28 Router DNS Hijacking for Adversary-in-the-Middle
CWE-287, CWE-346, CWE-350, CWE-798
Timeline of APT28 Router DNS Hijacking for Adversary-in-the-Middle
- APT28 begins compromising Ubiquiti EdgeRouters using default credentials and Trojanized OpenSSH processes to build proxy infrastructure for credential harvesting and spearphishing
- NCSC and CISA publish joint advisory on APT28 exploiting CVE-2017-6742 to deploy Jaguar Tooth malware on Cisco IOS routers for reconnaissance and backdoor access
- FBI disrupts APT28's Moobot botnet — hundreds of compromised Ubiquiti EdgeRouters used for credential harvesting, network proxying, and hosting spearphishing pages
- FBI, NSA, Cyber Command, and international partners publish joint advisory on APT28 use of compromised routers to facilitate cyber operations including credential theft
- APT28 conducts credential-stealing campaigns targeting Turkish energy and nuclear agencies, European think tanks, and organizations in North Macedonia and Uzbekistan using phishing pages hosted on compromised infrastructure
- APT28 launches 72-hour PRISMEX spearphishing blitz across nine Eastern European nations targeting defense ministries, transportation operators, and diplomatic entities via CVE-2026-21509
- NCSC publishes malware analysis report on AUTHENTIC ANTICS — APT28 malware that embeds in Outlook process to intercept Microsoft 365 credentials and OAuth tokens via COM hijacking
- Trend Micro publishes detailed analysis of Pawn Storm PRISMEX campaign with steganography, COM hijacking, and cloud C2 via Filen.io targeting NATO logistics
- Campaign confirmed as actively ongoing with opportunistic wide-net targeting that narrows to victims of intelligence interest
- NCSC UK publishes advisory exposing APT28 exploitation of vulnerable internet routers for DNS hijacking enabling AiTM credential theft from personal web and email services
- As of 2026-05-29, the FBI/DOJ "Operation Masquerade" (announced 2026-04-07) disrupted the U.S. portion of APT28's router DNS-hijacking network, but the fix is non-permanent — CVE-2023-50224/weak creds remain unpatched on most devices, GRU Unit 26165 is uncharged and active, and FBI was still warning of reinfection on May 21, so the threat persists.
Sources cited for APT28 Router DNS Hijacking for Adversary-in-the-Middle
- NCSC UK: UK exposes Russian military intelligence hijacking vulnerable routers for cyber attacks
- NCSC UK: APT28 exploits known vulnerability on Cisco routers
- CISA Advisory AA23-108A: APT28 Exploits Known Vulnerability to Deploy Malware on Cisco Routers
- FBI/NSA/Cyber Command: Russian Cyber Actors Use Compromised Routers to Facilitate Cyber Operations
- Trend Micro: Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure
- Microsoft: Analyzing Forest Blizzard custom post-compromise tool exploiting CVE-2022-38028
- NCSC UK: AUTHENTIC ANTICS Malware Analysis Report
- Sekoia: APT28 Operation Phantom Net Voxel
- The Hacker News: Russian APT28 Runs Credential-Stealing Campaign Targeting Energy and Policy Organizations
- MITRE ATT&CK: APT28 (G0007)
- BleepingComputer: FBI disrupts Russian Moobot botnet infecting Ubiquiti routers
- NCSC UK: Ongoing DNS hijacking and mitigation advice
Threats related to APT28 Router DNS Hijacking for Adversary-in-the-Middle
- APT28 (Fancy Bear) BEARDSHELL Backdoor & COVENANT C2 Framework — Long-term Ukrainian Military Espionage Campaign (CVE-2026-21509)
- Pawn Storm (APT28) Deploys PRISMEX Malware Suite via CVE-2026-21509 and CVE-2026-21513 Zero-Days Targeting Ukrainian Defense Supply Chain
- APT28 PixyNetLoader — Loader Evolution 2024–2026 (Operation Neusploit, CVE-2026-21509)
- APT28 Microsoft Office Security Feature Bypass (CVE-2026-21509) — CISA KEV, Targeting Ukraine & EU via COREPER-Themed Spear-Phishing
Detection coverage for TL-2026-0330
As of 2026-04-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0330 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.