A Russian state-sponsored hacking group has been targeting vulnerable consumer Wi-Fi routers, including 23 TP-Link models, some of which have reached “end of life” status.
The threat involves Fancy Bear, also known as APT 28, a notorious hacking group affiliated with Russian military intelligence. On Tuesday, Microsoft and the UK’s National Cyber Security Centre (NCSC) said the group has been hacking vulnerable routers to manipulate internet traffic and harvest login information.
“Microsoft Threat Intelligence has identified over 200 organizations and 5,000 consumer devices” that have been under attack since at least August, the company warned.
PCMag-Recommended Wi-Fi Routers
Microsoft did not identify the affected device models, but the NCSC published a list and said the Russians are targeting numerous TP-Link products, many of which were originally released over a decade ago. TP-Link lists over half of them as “end of life,” meaning they are no longer on sale and do not receive new software updates, including security patches.
(Credit: TP-Link)
(Credit: NCSC)
The NCSC urges the public to “apply security updates promptly” and “use modern systems and software,” suggesting that affected owners should replace outdated hardware. Although TP-Link offers automatic firmware updates, the feature appears to apply only to newer Archer models; everyone else needs to download and install firmware updates manually.
The US’s Justice Department is also calling on users to “Replace End-of-Life and End-of-Support routers.” Federal agents executed a court order to neutralize the US compromised routers by sending a series of commands to boot the Russian hackers out and prevent re-hijackings. That said, consumers can still reverse the change through a factory reset or by manually restoring the default settings.
“We urge all router owners to take the remediation steps outlined today, because defending our networks requires all of us,” Assistant Director Brett Leatherman of FBI’s Cyber Division said.
Get Our Best Stories!
Your Daily Dose of Our Top Tech News
By clicking Sign Me Up, you confirm you are 16+ and agree to our Terms of Use and Privacy
Policy.
Thanks for signing up!
Your subscription has been confirmed. Keep an eye on your inbox!
(Justice Department)
Germany’s intelligence office added that the Russian hackers were targeting outdated routers, which were replaced to stop the threat. “In total, APT28 attacked several thousand of these publicly accessible TP-Link devices. Approximately 30 vulnerable devices have been identified in Germany,” the office said.
The Russian hackers are likely hijacking routers using publicly known vulnerabilities, including CVE-2023-50224, which was disclosed two years ago. The flaw has been known to affect TP-Link TL-WR841N routers, a product that’s been around for nearly two decades and is still on the market as version v14; the v1 version was discontinued.
UK authorities also detected Russian hackers targeting “a small number of MikroTik routers, often located in Ukraine, that were likely of intelligence value to the actor.”
Recommended by Our Editors
Fancy Bear hijacks routers to overwrite Domain Name System settings, redirecting internet traffic intended for legitimate sites to hacker-controlled DNS servers, which can then ferry users to malicious web pages. Because the malicious web pages look like legitimate services, users can be fooled into entering their passwords and two-factor codes, which the hackers steal.
(Credit: NCSC)
“Lookups for domain names containing key terms associated with particular services, often email applications or login pages, would then be resolved by the malicious DNS servers to further actor-owned IP addresses,” the NCSC added. Although the spying can target a large number of users, the goal is to profile “victims of likely intelligence value,” the agency said.
TP-Link didn’t immediately respond to a request for comment. The hacking was disclosed after the US Federal Communications Commission enacted a controversial ban on new foreign-made Wi-Fi router models, citing the threat of supply chain vulnerabilities. All consumer router manufacturers are expected to be affected, as electronics manufacturing largely happens in Asia.
Sweeping Router Ban, Changing Your Gmail Name, Pixel 11 Leaks | Tech Today
Editor’s note: This story has been updated with information from the Justice Department.
About Our Expert
Michael Kan
Senior Reporter
Experience
I’ve been a journalist for over 15 years. I got my start as a schools and cities reporter in Kansas City and joined PCMag in 2017, where I cover satellite internet services, cybersecurity, PC hardware, and more. I’m currently based in San Francisco, but previously spent over five years in China, covering the country’s technology sector.
Since 2020, I’ve covered the launch and explosive growth of SpaceX’s Starlink satellite internet service, writing 600+ stories on availability and feature launches, but also the regulatory battles over the expansion of satellite constellations, fights with rival providers like AST SpaceMobile and Amazon, and the effort to expand into satellite-based mobile service. I’ve combed through FCC filings for the latest news and driven to remote corners of California to test Starlink’s cellular service.
I also cover cyber threats, from ransomware gangs to the emergence of AI-based malware. Earlier this year, the FTC forced Avast to pay consumers $16.5 million for secretly harvesting and selling their personal information to third-party clients, as revealed in my joint investigation with Motherboard.
I also cover the PC graphics card market. Pandemic-era shortages led me to camp out in front of a Best Buy to get an RTX 3000. I’m now following how President Trump’s tariffs will affect the industry. I’m always eager to learn more, so please jump in the comments with feedback and send me tips.
Read Full Bio
