Russian hackers hijack Ubiquiti routers to launch stealthy attacks

U.S. and allied agencies warn that Russian APT28 (Fancy Bear) has been abusing compromised Ubiquiti EdgeRouters—often left with default credentials and no automatic updates—to build botnets that harvest credentials (including NTLMv2), proxy malicious traffic, host phishing pages, and deploy custom espionage tooling; the advisory details observed artifacts, recent FBI disruption actions, and remediation steps (factory reset, firmware update, change defaults, and WAN firewall rules).