APT28 Router Compromise Exposes 18,000 Devices Through DNS Manipulation

Russian APT28 actors compromised over 18,000 TP-Link routers by exploiting default configurations and weak security settings to manipulate DNS configurations. The attackers used these compromised routers as pivot points to intercept and redirect network traffic from all connected devices, gaining extensive access to sensitive information flowing through small office and home networks. This attack demonstrates how poorly configured network infrastructure can provide attackers with persistent access to monitor and manipulate communications across entire network segments. The FBI's coordinated takedown involved remotely resetting DNS configurations, highlighting both the severity of the compromise and the challenge of securing distributed consumer network devices.