Afternoon Review in IT Security — April 8, 2026

The afternoon brings critical developments across multiple security fronts, from advanced persistent threat operations targeting network infrastructure to compliance violations at major financial institutions and active exploitation of WordPress vulnerabilities affecting millions of websites worldwide.

Russian Forest Blizzard Hackers Hijack Home Routers for Global Spying

Microsoft Threat Intelligence has exposed a sophisticated campaign by the Russian hacking group Forest Blizzard that leverages compromised home routers to conduct DNS hijacking and espionage operations. The threat actors exploit vulnerabilities in consumer-grade networking equipment to redirect user traffic and intercept sensitive communications at scale. Source: Russian Forest Blizzard Hackers Hijack Home Routers for Global Spying

The campaign demonstrates how attackers weaponize dnsmasq and employ man-in-the-middle techniques to maintain persistent access to victim networks. This infrastructure-level compromise allows the adversaries to conduct widespread surveillance operations with minimal detection risk, as the malicious activity occurs at a layer typically trusted by end users and organizations.

Hackers Targeting Ninja Forms Vulnerability That Exposes WordPress Sites to Takeover

A critical vulnerability in the Ninja Forms WordPress plugin is actively being exploited by threat actors to compromise websites globally. The flaw, tracked as CVE-2026-0740, permits attackers to upload arbitrary files to affected servers and achieve remote code execution, effectively enabling complete site takeover. Source: Hackers Targeting Ninja Forms Vulnerability That Exposes WordPress Sites to Takeover

Given the widespread deployment of Ninja Forms across WordPress installations, this vulnerability poses an immediate and significant threat to countless websites. Organizations running vulnerable versions of the plugin should prioritize patching efforts to prevent unauthorized access and data exfiltration.

Intesa Sanpaolo Fined €31.8 Million for Insider Data Breach

Italy's Data Protection Authority has imposed a substantial €31.8 million fine against Intesa Sanpaolo, a major Italian banking institution, following a significant data breach involving unauthorized employee access to customer financial data. The breach, which occurred between 2022 and 2024, initially affected nine data subjects according to the bank's reporting, but subsequent investigation revealed over 3,500 affected individuals. Source: Garante per la protezione dei dati personali (Italy) - 10234984

The DPA identified multiple violations of GDPR articles, including failures in data security implementation, inadequate monitoring systems that failed to detect anomalous access patterns over a two-year period, and improper breach notification procedures. The authority emphasized that the bank's failure to promptly and accurately report the breach, coupled with delayed notification to affected data subjects, constituted serious compliance violations. Notably, the compromised data included financial information of high-risk customers including public and political figures, amplifying the severity of the incident.

US Disrupts Russian Espionage Operation Involving Hacked Routers and DNS Hijacking

United States authorities have disrupted a Russian espionage operation conducted by the APT28 threat group that exploited vulnerabilities in TP-Link and MikroTik routers to perform adversary-in-the-middle attacks against targets worldwide. The operation leveraged CVE-2023-50224 and deployed multiple malware variants including Storm-2754 and FrostArmada to maintain persistent control over compromised network infrastructure. Source: US Disrupts Russian Espionage Operation Involving Hacked Routers and DNS Hijacking

The disruption represents a significant counterintelligence success against a state-sponsored threat actor known for sophisticated targeting of government and critical infrastructure entities. The operation's reliance on small office and home office (SOHO) router vulnerabilities underscores the importance of maintaining firmware updates and implementing network segmentation to limit exposure from compromised edge devices.

The afternoon's developments underscore the persistent threat landscape facing organizations, from nation-state actors exploiting network infrastructure to financially motivated threat actors targeting web applications and insider threats compromising sensitive financial data. Immediate patching, robust monitoring, and comprehensive incident response protocols remain essential defensive measures.