APT28 Exploits SOHO Router Vulnerabilities for Global DNS Hijacking

APT28 successfully compromised over 18,000 SOHO routers by exploiting unpatched vulnerabilities and weak default configurations to modify DNS settings. The attackers redirected legitimate traffic to malicious servers, enabling man-in-the-middle attacks that captured sensitive credentials and OAuth tokens from government and enterprise users. This campaign highlights how consumer-grade network devices with poor security hygiene can become critical infrastructure vulnerabilities, providing persistent access for sophisticated threat actors to conduct large-scale espionage operations.

Tactical Insight

Immediate actions

Audit all SOHO routers and network devices for available firmware updates and apply immediately
Change default administrative credentials on all network appliances to strong, unique passwords
Verify DNS settings on all routers match authorized DNS servers

Long-term improvements

Implement automated vulnerability scanning for all internet-facing network infrastructure
Establish a hardware inventory management system to track firmware versions and security patches
Deploy network monitoring to detect unauthorized DNS configuration changes

Detection measures

Monitor DNS query logs for suspicious redirection patterns or unauthorized DNS servers
Implement certificate pinning and HSTS to detect man-in-the-middle attacks on critical applications