[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7hXi9jMWnAcaz0GykUnXB6Upk26L7FHpqD8Ebs29WNI":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"status":18,"created_at":19,"published_at":20,"article":21,"tags":25,"podcasts":38},"93d6c862-6b6c-4d62-8c08-1e359ae1a0a3","russian-military-exploits-unpatched-router-vulnerabilities-for-dns-hijacking-campaign","0285b188-cdc2-4ff2-b34f-8739c4bd6718","Russian Military Exploits Unpatched Router Vulnerabilities for DNS Hijacking Campaign","Russian GRU Unit 26165 successfully compromised thousands of SOHO routers by exploiting known TP-Link vulnerabilities to conduct DNS hijacking and credential harvesting attacks against U.S. critical infrastructure. The attackers leveraged unpatched router firmware and default configurations to establish persistent access and perform man-in-the-middle attacks. This incident demonstrates how seemingly minor network devices can become critical attack vectors when proper vulnerability management and security hardening practices are not implemented.","**Immediate actions:**\n- Update all SOHO router firmware to the latest versions immediately\n- Change default DNS settings to secure, trusted DNS providers\n- Disable unnecessary router services and features to reduce attack surface\n\n**Long-term improvements:**\n- Implement automated vulnerability scanning for all network appliances including SOHO devices\n- Establish regular firmware update schedules for all network infrastructure components\n- Deploy network monitoring to detect unusual DNS queries and traffic patterns\n\n**Detection measures:**\n- Monitor DNS resolution logs for suspicious redirections or unauthorized changes\n- Implement network traffic analysis to identify potential man-in-the-middle attacks\n- Set up alerts for configuration changes on critical network infrastructure devices",[12,13,14,15,16,17],"CIS Control 7","CIS Control 11","NIST CM-3","NIST SI-2","NIST CM-6","NIST SI-4","published","2026-04-07T22:09:16.64779+00:00","2026-04-07T22:09:16.065+00:00",{"id":7,"url":22,"slug":23,"title":24},"https:\u002F\u002Fwww.justice.gov\u002Fopa\u002Fpr\u002Fjustice-department-conducts-court-authorized-disruption-dns-hijacking-network-controlled","justice-department-conducts-court-authorized-disruption-of-dns-hijacking-network","Justice Department Conducts Court-Authorized Disruption of DNS Hijacking Network Controlled by a Russian Military Intelligence Unit",[26,32],{"id":27,"name":28,"slug":29,"description":30,"color":31},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":33,"name":34,"slug":35,"description":36,"color":37},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[39],{"id":40,"date":41,"edition":42,"title":43,"audio_url":44},"8e2385b4-6a92-4f4f-b962-9ec64e239a06","2026-04-08","morning","ThreatNoir Morning Brief — April 8","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-04-08\u002Fthreatnoir-morning-brief-2026-04-08.mp3"]