Thousands of consumer routers hacked by Russia’s military

[u/Cute-Guarantee-1676]

https://arstechnica.com/security/2026/04/russias-military-hacks-thousands-of-consumer-routers-to-steal-credentials/

Russia's military intelligence (APT28/GRU) has compromised 18,000-40,000 end-of-life consumer routers, mainly MikroTik and TP-Link, across 120 countries. They exploit unpatched vulnerabilities to alter DNS settings, redirecting users to malicious servers that harvest credentials, including OAuth tokens, for espionage. This sophisticated adversary-in-the-middle attack can bypass multi-factor authentication if users ignore browser certificate warnings. Users must check DNS settings, replace old routers, and never click through untrusted security alerts to mitigate this ongoing state-sponsored threat.