Russian state hackers are hijacking TP-Link and MicroTik routers to steal Outlook credentials, cybersecurity center warns — APT28 group targets DNS and redirects traffic to attacker-controlled servers

The UK National Cyber Security Centre (NCSC) has issued a warning about Russian state hacking group APT28 targeting TP-Link and MicroTik routers to steal Outlook credentials. APT28 redirects traffic through attacker-controlled DNS servers to harvest passwords and authentication tokens. The group exploits vulnerabilities in routers to rewrite DHCP and DNS settings, directing traffic to malicious servers. The NCSC advises keeping router firmware updated and enabling multi-factor authentication to mitigate risks. APT28, also known as Fancy Bear, has been previously linked to high-profile cyberattacks.