Russian Hackers Are Inside American Home Routers. The FBI Has a 5-Step Fix

Source: NSA

Russian Hackers Are Inside American Home Routers. The FBI Has a 5-Step Fix

Most home routers sit in a corner, ignored, and that’s exactly what Russia’s military intelligence unit was counting on. The GRU group known as APT28, responsible for some of the most significant state-sponsored hacks of the past decade, spent years exploiting that neglect, working its way into thousands of home and small office routers across 23 US states and using the access to intercept traffic, steal credentials and build a shadow network of compromised devices. A joint federal advisory issued April 7 outlined the scope of the attack and the court-authorized operation that disrupted it. It also came with a clear instruction: There are five steps every router owner should take immediately.

The attack targeted small-office/home-office routers, also known as SOHO routers, and was carried out by a unit in the Russian military intelligence agency, the GRU. Government agencies are urging people to follow basic router hygiene steps, such as updating to the latest firmware and changing default login credentials. The UK’s National Cyber Security Centre includes a number of TP-Link routers specifically targeted by the hackers.

While that news sounds pretty alarming, it’s worth keeping in mind that the attack compromised enterprise routers specifically, so your home Wi-Fi router likely isn’t at risk. That said, some of the affected routers can be used as standard home routers, so it’s worth checking whether your model was exploited in the attack.

“There is a big trend of exploiting routers these days, and that goes both for the consumer and enterprise or corporate routers,” Daniel Dos Santos, vice president of research at the cybersecurity company Forescout, told CNET.

What type of attack is this?

A news release from the NSA notes that the attack indiscriminately targeted a wide pool of routers, with the goal of gathering information on “military, government, and critical infrastructure.”

This attack is linked to threat actors within the Russian GRU — which go by APT28, Fancy Bear, Forest Blizzard and other names — and has been ongoing since at least 2024, according to the FBI.

It’s known as a Domain Name System hijacking operation, in which DNS requests are intercepted by changing the default network configurations on SOHO routers, allowing the actors to see a user’s traffic unencrypted. “For nation-state actors like Forest Blizzard, DNS hijacking enables persistent, passive visibility and reconnaissance at scale,” says a Microsoft Threat Intelligence report on the attack.

Microsoft identified more than 200 organizations and 5,000 consumer devices impacted by the GRU’s attack.

Which routers were affected?

The FBI’s announcement refers to one router specifically, the TP-Link TL-WR841N, a Wi-Fi 4 model that was originally released in 2007. The UK’s National Cyber Security Centre lists 23 TP-Link models that were targeted, but notes that it is likely not exhaustive.

Here is the list of affected devices:

READ MORE