Critical · published 7 April 2026 · last verified 17 August 2026
APT28 / Russian GRU DNS hijacking
DNS hijacking used to redirect traffic and harvest credentials.
Scope caveat: This does not mean every TP-Link or MikroTik router was compromised. Exposure depends on the exact model, hardware revision and firmware.
- Affected products
- Vulnerable TP-Link and MikroTik routers
- Hardware revisions
- Model and hardware-revision specific
- Firmware range
- Unpatched builds identified in the advisory
- Threat
- APT28 / Russian GRU DNS hijacking
- CVE references
- See advisory for referenced CVEs
- Impact
- DNS hijacking used to redirect traffic and harvest credentials.
- Conditions required
- Requires an unpatched or end-of-life device, often with remote management or weak admin credentials exposed.
- Vendor response
- Vendors published firmware for supported models; some affected units are end-of-life.
- Consumer action
- Update supported firmware, replace end-of-life hardware, and check DNS and admin settings.
- Status
- Active
- Source type
- Government