Russian hackers hijack internet traffic using vulnerable routers
Overview
The UK’s National Cyber Security Centre (NCSC) has issued a warning about the Russian cyber group APT28, which is reportedly hijacking internet traffic by compromising vulnerable routers. The attackers manipulate DHCP and DNS settings to redirect user traffic through their own servers, allowing them to spy on victims. This activity is linked to the GRU's Military Intelligence Unit 26165. Organizations and individuals using susceptible routers may be at risk, making it crucial for them to secure their devices against such exploits. The ongoing activity highlights the need for constant vigilance in network security, especially when it comes to maintaining router configurations.
Key Takeaways
- Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
- Affected Systems: Vulnerable routers, particularly those with weak security configurations.
- Action Required: Users should secure their router configurations, update firmware to the latest versions, and implement strong passwords.
- Timeline: Ongoing since 2024
Original Article Summary
The Russian state cyber group APT28 has been compromising routers to hijack web traffic and spy on victims, the UK’s The National Cyber Security Centre (NCSC) has warned. Attackers are exploiting vulnerable routers to alter DHCP and DNS settings, redirecting traffic through servers they control. “We assess that APT28 is almost certainly the Russian General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Centre (GTsSS) Military Intelligence Unit 26165.” said NCSC. Since 2024, APT28 … More → The post Russian hackers hijack internet traffic using vulnerable routers appeared first on Help Net Security.
Impact
Vulnerable routers, particularly those with weak security configurations.
Exploitation Status
This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.
Timeline
Ongoing since 2024
Remediation
Users should secure their router configurations, update firmware to the latest versions, and implement strong passwords. Specific patches or configurations were not mentioned.
Additional Information
This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.