Russian Hackers Compromise Thousands of Home Routers

A Russian government-linked hacking group, identified as Fancy Bear (APT28), has compromised thousands of home and small business routers globally. The attackers exploit unpatched vulnerabilities in routers from manufacturers like MicroTik and TP-Link to redirect internet traffic. This allows them to steal passwords and access tokens by directing users to spoofed websites, bypassing two-factor authentication. Researchers from Lumen's Black Lotus Labs and the UK's NCSC, along with Microsoft, have detailed the campaign, which has affected at least 18,000 victims in approximately 120 countries. The FBI is expected to announce actions against domains used in this operation.