# APT28 Router DNS Hijacking for Adversary-in-the-Middle Credential Theft

> Russian GRU-linked APT28 (Fancy Bear / Forest Blizzard / Pawn Storm) is exploiting vulnerable internet-facing SOHO routers to hijack DNS resolution, enabling adversary-in-the-middle (AiTM) interception of user traffic to harvest login credentials, passwords, and OAuth access tokens from personal web and email services. NCSC UK advisory published 2026-04-07 warns of opportunistic wide-net targeting that narrows to intelligence-value victims.

- **Published:** 2026-04-07T12:00:00Z
- **Last reviewed:** 2026-04-07T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0330
- **ID:** TL-2026-0330
- **Severity:** HIGH
- **Category:** APT
- **Status:** MONITORING
- **Actor:** APT28 (Russia)
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2017-6742, CVE-2026-21513

## Description

On April 7, 2026, the UK National Cyber Security Centre (NCSC) published an advisory exposing an active campaign by Russian state cyber group APT28 that exploits vulnerable internet routers to conduct DNS hijacking operations. APT28 — attributed to Russia's GRU 85th Main Special Service Centre (GTsSS), Military Unit 26165 — compromises commonly used SOHO routers and reconfigures their DNS settings to covertly reroute victim internet traffic through attacker-controlled servers.

The DNS hijacking technique is a form of adversary-in-the-middle (AiTM) attack. By modifying DNS resolution on compromised routers, APT28 redirects users attempting to reach legitimate web and email services to malicious intermediary servers. These servers present convincing credential harvesting pages or transparently proxy traffic while extracting authentication material — including passwords, session cookies, and OAuth 2.0 access tokens — before forwarding victims to the real service. This makes the compromise invisible to end users.

The campaign follows an opportunistic targeting model: APT28 initially casts a wide net by compromising large numbers of vulnerable routers, then narrows focus to victims of intelligence interest as the operation develops. This pattern is consistent with APT28's documented tradecraft of bulk infrastructure compromise followed by selective exploitation.

This campaign builds on APT28's extensive history of router exploitation. In February 2024, the FBI disrupted the Moobot botnet — a network of hundreds of compromised Ubiquiti EdgeRouters that APT28 had been using since at least 2022 to harvest credentials, proxy network traffic, and host spearphishing landing pages. The actors accessed EdgeRouters using default credentials and deployed Trojanized OpenSSH server processes, Python credential-harvesting scripts, and custom routing rules to redirect phishing traffic. Despite the FBI takedown, APT28 has continued to target router infrastructure.

APT28's router exploitation is also linked to their exploitation of CVE-2017-6742, an SNMP remote code execution vulnerability in Cisco IOS and IOS XE routers. The NCSC and CISA jointly documented APT28 deploying the Jaguar Tooth malware to Cisco routers via this vulnerability to collect device and network information and establish backdoor access.

The DNS hijacking campaign connects to APT28's broader 2026 operational tempo. The group has been conducting parallel campaigns including: the PRISMEX malware deployment targeting NATO logistics and Eastern European government entities via CVE-2026-21509 and CVE-2026-21513; the AUTHENTIC ANTICS credential theft malware that embeds within Outlook processes to intercept Microsoft 365 credentials and OAuth tokens; credential harvesting campaigns targeting Turkish energy, European think tanks, and organizations across North Macedonia and Uzbekistan; and the BEARDSHELL/COVENANT malware campaign targeting Ukrainian military infrastructure.

The DNS hijacking operation is particularly dangerous because it operates at the network infrastructure layer, affecting all devices using the compromised router for DNS resolution. Individual endpoint security controls may not detect the compromise since traffic appears to flow normally from the endpoint perspective. Organizations and individuals relying on compromised routers for DNS resolution are exposed to credential theft across all web services accessed through that connection.

Mitigation requires securing router management interfaces, applying firmware patches, changing default credentials, implementing DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) on endpoints, deploying multi-factor authentication on all critical accounts, and monitoring for DNS configuration changes on network devices.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1557 Adversary-in-the-Middle
- T1110 Brute Force
- T1528 Steal Application Access Token
- T1187 Forced Authentication
- T1114 Email Collection
- T1546 Event Triggered Execution
- T1505 Server Software Component
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1090 Proxy
- T1102 Web Service
- T1584 Compromise Infrastructure
- T1588 Obtain Capabilities
- T1016 System Network Configuration Discovery
- T1021 Remote Services
- T1567 Exfiltration Over Web Service
- T1498 Network Denial of Service

## Sources

- [NCSC UK: UK exposes Russian military intelligence hijacking vulnerable routers for cyber attacks](https://www.ncsc.gov.uk/news/uk-exposes-russian-military-intelligence-hijacking-vulnerable-routers-for-cyber-attacks)
- [NCSC UK: APT28 exploits known vulnerability on Cisco routers](https://www.ncsc.gov.uk/news/apt28-exploits-known-vulnerability-to-carry-out-reconnaissance-and-deploy-malware-on-cisco-routers)
- [CISA Advisory AA23-108A: APT28 Exploits Known Vulnerability to Deploy Malware on Cisco Routers](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-108)
- [FBI/NSA/Cyber Command: Russian Cyber Actors Use Compromised Routers to Facilitate Cyber Operations](https://media.defense.gov/2024/Feb/27/2003400753/-1/-1/0/CSA-Russian-Actors-Use-Routers-Facilitate-Cyber_Operations.PDF)
- [Trend Micro: Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure](https://www.trendmicro.com/en_us/research/26/c/pawn-storm-targets-govt-infra.html)
- [Microsoft: Analyzing Forest Blizzard custom post-compromise tool exploiting CVE-2022-38028](https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/)
- [NCSC UK: AUTHENTIC ANTICS Malware Analysis Report](https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/authentic-antics/ncsc-mar-authentic_antics.pdf)
- [Sekoia: APT28 Operation Phantom Net Voxel](https://blog.sekoia.io/apt28-operation-phantom-net-voxel/)
- [The Hacker News: Russian APT28 Runs Credential-Stealing Campaign Targeting Energy and Policy Organizations](https://thehackernews.com/2026/01/russian-apt28-runs-credential-stealing.html)
- [MITRE ATT&CK: APT28 (G0007)](https://attack.mitre.org/groups/G0007/)
- [BleepingComputer: FBI disrupts Russian Moobot botnet infecting Ubiquiti routers](https://www.bleepingcomputer.com/news/security/fbi-disrupts-russian-moobot-botnet-infecting-ubiquiti-routers/)
- [NCSC UK: Ongoing DNS hijacking and mitigation advice](https://www.ncsc.gov.uk/news/ongoing-dns-hijacking-and-mitigation-advice)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0330