Russian hackers hijack internet traffic using vulnerable routers

The UK NCSC warns that APT28 (linked to the Russian GRU) has been compromising SOHO routers—including TP-Link WR841N via CVE-2023-50224—to modify DHCP/DNS settings and route traffic through attacker-controlled DNS servers, enabling man-in-the-middle interception of browser sessions and authentication data; investigators identified two clusters of malicious DNS infrastructure and recommend following the advisory's mitigation guidance.