Signal
Russian APT28 exploits SOHO routers for espionage and AiTM attacks
Evidence first: scan the strongest sources, then decide whether to go deeper.
Published 2026-04-07 19:48 UTCUpdated 2026-04-08 13:50 UTC
rss
cveexploitsbreachesmalwarethreat_actorsadvisories
Source links open
Source links and full evidence are open here. Archive history, compare-over-time, alerts, exports, API, integrations, and workflow are paid.
No card needed for the free brief.
Evidence trail (top sources)
top sources (4 domains)domains are deduped. counts indicate coverage, not truth.4 top sources shown
Overview
The Russian threat group APT28, also known as Forest Blizzard and Fancy Bear, has been conducting a widespread cyber espionage campaign by compromising home and small office routers.
Entities
MicrosoftTP-LinkMikroTikPRISMEX
Score total
1.47
Momentum 24h
5
Posts
5
Origins
5
Source types
1
Duplicate ratio
0%
Why now
- Recent US disruption of the operation indicates active countermeasures against APT28.
- The discovery of PRISMEX malware shows APT28’s continued evolution and targeting of Ukraine and NATO allies.
- The widespread impact on thousands of devices underscores the urgency for improved SOHO router security.
Why it matters
- APT28’s router compromises enable interception of sensitive cloud communications, risking credential theft.
- The attacks target critical sectors, including government and energy, impacting national security.
- Disruption efforts by the US highlight the ongoing geopolitical cyber conflict involving state-sponsored espionage.
LLM analysis
Topic mix: lowPromo risk: lowSource quality: medium
Recurring claims
- APT28 compromises SOHO routers to hijack DNS settings and spy on users.
- APT28 uses DNS hijacking to conduct adversary-in-the-middle attacks targeting Microsoft Outlook web sessions.
- APT28 deployed PRISMEX malware in spear-phishing campaigns against Ukraine and NATO allies.
How sources frame it
- Malwarebytes Threat Analysis: neutral
- CSO Online: neutral
- SecurityWeek: neutral
- BankInfoSecurity: neutral
This briefing consolidates recent reports on APT28's exploitation of SOHO routers for espionage and AiTM attacks, highlighting the group's evolving tactics including PRISMEX malware deployment.
All evidence
All evidence
APT28 Deploys PRISMEX Malware in Campaign Targeting Ukraine and NATO Allies
The Hacker News · thehackernews.com · 2026-04-08 13:50 UTC
Russian hacking group targets home and small office routers to spy on users
Malwarebytes Threat Analysis · malwarebytes.com · 2026-04-08 13:31 UTC
US Disrupts Russian Espionage Operation Involving Hacked Routers and DNS Hijacking
SecurityWeek · securityweek.com · 2026-04-08 10:54 UTC
Forest Blizzard leverages router compromises to launch AiTM attacks, target Outlook sessions
CSO Online · csoonline.com · 2026-04-08 10:50 UTC
Russian Hackers Hit SOHO Routers in Cyberespionage Campaign
BankInfoSecurity · bankinfosecurity.com · 2026-04-07 19:48 UTC
Show filters & breakdown
Posts loaded: 0Publishers: 5Origin domains: 5Duplicates: -
Showing 5 / 0
Top publishers (this list)
- The Hacker News (1)
- Malwarebytes Threat Analysis (1)
- SecurityWeek (1)
- CSO Online (1)
- BankInfoSecurity (1)
Top origin domains (this list)
- thehackernews.com (1)
- malwarebytes.com (1)
- securityweek.com (1)
- csoonline.com (1)
- bankinfosecurity.com (1)