APT28 Exploits Vulnerable Routers for Global DNS Hijacking Campaign

Russian-linked APT28 (Fancy Bear) has exploited vulnerabilities in TP-Link and MikroTik routers—including CVE-2023-50224—to hijack DNS on over 18,000 devices across 120 countries, enabling interception of traffic and credential/token theft against military, government, and critical infrastructure targets; authorities (DOJ/FBI) executed a takedown called Operation Masquerade and vendors/security agencies have issued advisories urging immediate patching and mitigation.