Loading story…
Russia-linked APT28 exploited poorly maintained Cisco routers worldwide for reconnaissance and malware deployment, according to a joint UK NCSC, US NSA, CISA and FBI advisory. The agencies assessed that APT28 is almost certainly Russia’s GRU Military Intelligence Unit 26165. The campaign, conducted in 2021, targeted devices in Europe, US government institutions and approximately 250 Ukrainian victims. Attackers used weak SNMP community strings for reconnaissance and exploited CVE-2017-6742. On some routers, they deployed Jaguar Tooth, which collected device and network information, exfiltrated it over TFTP and enabled unauthenticated backdoor access.
The agencies recommended patching affected routers, restricting SNMP access, replacing unencrypted management protocols and monitoring device commands. Potentially compromised devices require replacement of firmware and keys. The disclosure followed earlier government action addressing Russian cyber operations: the UK imposed sanctions over the attack on Germany’s parliament in 2020, and a 2021 US defense advisory addressed a GRU global brute-force campaign. For defenders, the router campaign underscores the need to secure network infrastructure as an espionage target, rather than focusing solely on endpoints and user accounts.
See which actors are running it and whether you're in range.
7 events from the most recent confirmed update back to the earliest known activity.
The NCSC, NSA, CISA and FBI published a joint advisory detailing the 2021 campaign and assessing APT28 as almost certainly Russia's GRU Military Intelligence Unit 26165. An accompanying NCSC Jaguar Tooth analysis provided indicators of compromise and technical details, while the advisory recommended patching and hardening router management.
During the campaign, APT28 exploited CVE-2017-6742 and deployed Jaguar Tooth on some targeted routers. The malware collected device and network information, exfiltrated it over TFTP and enabled unauthenticated backdoor access.
APT28 used infrastructure to disguise SNMP access and exploited weak community strings, including the default string 'public', to collect router information and enumerate interfaces. Targets included routers in Europe, US government institutions and approximately 250 Ukrainian victims.
An attempted attack targeted the Organisation for the Prohibition of Chemical Weapons. The NCSC subsequently attributed it to APT28 and described its objective as disrupting independent analysis of chemicals weaponised by the GRU in the UK.
Cisco announced CVE-2017-6742, tracked internally as CSCve54313, and made patched software available. Its advisory also provided workarounds, including restricting SNMP access to trusted hosts or disabling specified Management Information Bases.
Cyberattacks against the German parliament involved data theft and disruption of email accounts belonging to German MPs and the Vice Chancellor. The NCSC subsequently attributed the attacks to APT28.
The UK government reported enforcing new sanctions against Russia for the cyberattack on the German parliament.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
ncsc.gov.uk
Open sourcegov.uk
Open sourcemedia.defense.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A joint advisory from cybersecurity agencies in 12 countries warned that Russian state hackers linked to **FSB Center 16** are actively targeting vulnerable routers worldwide, focusing on devices exposed with default or weak SNMP credentials and community strings. The agencies said the actors can abuse SNMP to copy router configurations through OIDs and exfiltrate them over TFTP, while also exploiting older network-device flaws such as `CVE-2018-0171` on Cisco equipment. High-risk sectors identified in the warning include communications, defence, energy, financial services, government, and healthcare, and the activity follows formal UK and EU attribution of cyber-attacks on Poland’s energy infrastructure to the same Russian service. Separate reporting highlighted how compromised SOHO and home-office routers can be used for **DNS hijacking** that bypasses endpoint security and enables credential theft against remote workers. The attack path described combines documented Russian tradecraft, including APT28-linked router compromises, with downstream abuse such as redirecting traffic, harvesting **NTLMv2** hashes, and stealing Microsoft 365 credentials and tokens. Defenders were urged to harden or replace poorly secured routers, move to **SNMPv3**, disable unnecessary exposed services, monitor for unauthorized DNS resolver changes and NXDOMAIN spikes, and factory-reset suspected devices before rotating affected credentials.
Aug 15, 2026
British and U.S. officials said hackers linked to Russia’s GRU, including **APT28**/**Fancy Bear** and assessed as tied to **Unit 26165**, have run a broad campaign compromising home, small-office, ISP, and business edge devices to spy on targets and steal data. Authorities said the operators abused weak or default **SNMP** community strings, outdated `SNMPv2` deployments, and known vulnerabilities in routers and firewalls, including some **TP-Link** devices, to gain access and persist on internet-facing infrastructure worldwide. Once inside, the attackers altered router configurations to reroute traffic through infrastructure they controlled, enabling surveillance, credential interception, network mapping, and adversary-in-the-middle activity such as **DNS** manipulation and redirection to fraudulent sites. Recent reporting said investigators disrupted a Russia-backed espionage network spanning roughly **18,000 devices**, while UK guidance urged organizations to lock down management interfaces, disable or restrict SNMP, upgrade protocols, and apply security updates to exposed edge equipment.
Jun 29, 2026
The FBI disrupted an **APT28** operation that compromised internet-connected routers to enable **DNS hijacking**, according to reporting citing U.S. and UK government findings. The campaign abused vulnerable edge devices to alter DNS settings and redirect traffic, giving the Russian state-linked group a way to intercept victim communications, harvest credentials, and support follow-on espionage activity. The activity was significant enough to prompt public warnings from the FBI and the UK **NCSC**, which described router exploitation as a key enabler for the hijacking operations. Government guidance tied the operation to exploitation of routers exposed to the internet and urged organizations to harden perimeter infrastructure by patching devices, restricting remote administration, rotating credentials, and reviewing DNS configurations for unauthorized changes. The disclosures underscore how Russian espionage actors continue to rely on stealthy network-level tradecraft—using compromised infrastructure rather than malware alone—to persist in victim environments and covertly redirect or monitor traffic.
Jun 29, 2026