A group of Russian government hackers have hijacked thousands of home and small business routers around the world as part of an ongoing campaign aimed at redirecting victim’s internet traffic to steal their passwords and access tokens, security researchers and government authorities warned on Tuesday.
This is the latest tactic by the long-running Russian hacking group known as Fancy Bear, or APT 28, known for its high-profile hacks and spying operations, including the breach of the Democratic National Committee in 2016 and the destructive hack that hit satellite provider Viasat in 2022. Fancy Bear is widely believed to be part of Russia’s intelligence agency GRU.
The hacking group targeted unpatched routers made by MikroTik and TP-Link using previously disclosed vulnerabilities according to the U.K. government’s cybersecurity unit NCSC and Lumen’s research arm Black Lotus Labs, which released new details of the campaign Tuesday.
According to the researchers, the hackers were able to spy on large numbers of people over the course of several years by compromising their routers, many of which run outdated software, leaving them vulnerable to remote attacks without their owners’ knowledge.
The NCSC said that these operations are “likely opportunistic in nature, with the actor casting a wide net to reach many potential victims, before narrowing in on targets of intelligence interest as the attack develops.”
Per the researchers and government advisories, the Russian hackers hacked routers to modify the device’s settings so that the victim’s internet requests are surreptitiously passed to infrastructure run by the hackers. This allows the hackers to redirect victims to spoof websites under their control, then steal passwords and tokens that let the hackers log in to that victim’s online accounts without needing their two-factor authentication codes.
Black Lotus Labs said that Fancy Bear compromised at least 18,000 victims in around 120 countries, including government departments, law enforcement agencies, and email providers across North Africa, Central America, and Southeast Asia.
This Week Only: Save up to $500 for Disrupt 2026
This Week Only: Save up to $500 for Disrupt 2026
Microsoft, which also released details of the campaign on Tuesday, said in a blog post that its researchers identified over 200 organizations and 5,000 consumer devices affected by these hacking operations, including at least three government organizations in Africa.
The FBI is expected to announce the takedown of several domains used in this campaign by the hackers. Lumen said it was part of a coalition, including the FBI, that disrupted the botnet and took it offline.
A spokesperson for the FBI did not respond to requests for comment prior to publication.
On Tuesday afternoon, the U.S. Justice Department announced that it neutralized the compromised routers located on U.S. soil, thanks to a court authorization. The DOJ said that the FBI “developed a series of commands to send to compromised routers,” to collect evidence, reset settings, and prevent hackers from breaking back in.
Updated to include information from DOJ’s announcement.
