Russian Hackers Compromise 18,000 Routers in Global Espionage

Russian military intelligence-linked hackers have compromised thousands of home and small office internet routers worldwide in a sprawling cyberespionage campaign, redirecting traffic to steal login credentials and monitor sensitive communications, according to cybersecurity authorities and researchers.

The group, known as APT28 or Fancy Bear and assessed to operate under Russia's GRU military intelligence agency, began exploiting vulnerabilities in devices from manufacturers such as MikroTik and TP-Link as early as 2024. By modifying domain name system settings on these routers, the hackers rerouted internet queries through servers they controlled, enabling passive surveillance of network activity and targeted adversary-in-the-middle attacks. This allowed them to intercept passwords, authentication tokens and other data from email services and web logins, often without users noticing beyond occasional certificate warnings.

At its height in late 2025, the operation affected more than 18,000 unique IP addresses across at least 120 countries, impacting over 200 organizations and 5,000 consumer devices. Primary targets included government ministries, law enforcement agencies,...