The Russian military's elite hacking squad, APT28, has infiltrated thousands of consumer routers worldwide, turning them into espionage tools. Lumen Technologies’ Black Lotus Labs reported that an estimated 18,000 to 40,000 devices, primarily MikroTik and TP-Link models, have been compromised in 120 countries.

The group uses these routers as proxies to spy on government agencies and ministries. By changing DNS settings, they reroute internet traffic through servers under their control, effectively monitoring online activities without being detected.

This latest operation underscores APT28’s adaptability. They have been known to leverage both cutting-edge technology like the LAMEHUG large language model with traditional hacking techniques, ensuring their campaigns remain effective despite security patches and public awareness.

The hackers target older router models that haven’t been updated against known vulnerabilities. Once in control, they use DHCP to spread malicious DNS settings across connected devices. This method allows them to intercept and redirect internet traffic, capturing valuable data without drawing suspicion.

The widespread nature of this attack highlights the ongoing challenge faced by cybersecurity experts worldwide. As home networks become increasingly integrated into our daily lives, they also present new vectors for state-sponsored espionage.