{"id":"apt28-router-dns-hijacking-tp-link-apr-2026","category":"patch","status":"closed","title":"Russian GRU hackers hijack TP-Link and other home routers to steal logins (CVE-2023-50224)","tldr":"Russia's APT28 hijacked home and small-office routers, mainly TP-Link, to redirect traffic and steal passwords and tokens. The FBI reset many routers, but replace end-of-life routers, update firmware, change default logins and switch off remote management.","summary":"The FBI, UK NCSC, Microsoft and partner agencies reported on 7 April 2026 that Russia's military intelligence unit APT28 (also called Fancy Bear or Forest Blizzard) had taken over small-office and home routers. The attackers changed the routers' DNS settings so connected phones and laptops used attacker-run servers, which returned false answers for services such as Outlook on the web. The FBI and NCSC say TP-Link routers were compromised using CVE-2023-50224, an authentication flaw in the TL-WR841N that leaks stored credentials. The NCSC also named MikroTik routers in a second cluster. Microsoft counted more than 200 organisations and about 5,000 consumer devices affected; CyberScoop reported more than 18,000 compromised TP-Link routers, so counts differ between sources. The FBI said it had disrupted the network, and CyberScoop reported it sent commands to restore the routers' DNS settings. TP-Link's advisory says the TL-WR841N may be end-of-life, and CISA's catalogue tells users to stop using affected products. No charges were reported in the sources read.","action":"Replace any TP-Link TL-WR841N or other end-of-support router, as TP-Link lists the WR841N as possibly no longer supported. Update firmware on other routers, change default admin passwords, turn off remote management, and treat browser certificate warnings as a stop sign.","product":"TP-Link TL-WR841N and other home and small-office routers (TP-Link, MikroTik)","audience":"both","severity":"high","patch":"partial","exploited":true,"cves":["CVE-2023-50224"],"tags":["tp-link","router","apt28","dns-hijacking","russia","fbi","cisa-kev","home-router"],"affected":["TP-Link TL-WR841N (CISA lists firmware below 12.0 as affected)","Other TP-Link small-office and home routers named by NCSC: Archer C5/C7, WDR series","Some MikroTik routers in a second cluster (NCSC)"],"fixed":[],"matches":[{"platform":"router","app":"TP-Link TL-WR841N","bundle":"","fixed":""}],"sources":[{"kind":"advisory","title":"Russian GRU hackers exploit routers (FBI PSA I-040726)","url":"https://www.ic3.gov/PSA/2026/PSA260407","by":"FBI IC3","date":"2026-04-07"},{"kind":"research","title":"SOHO router compromise leads to DNS hijacking and adversary-in-the-middle attacks","url":"https://www.microsoft.com/en-us/security/blog/2026/04/07/soho-router-compromise-leads-to-dns-hijacking-and-adversary-in-the-middle-attacks/","by":"Microsoft","date":"2026-04-07"},{"kind":"advisory","title":"APT28 exploit routers to enable DNS hijacking operations","url":"https://www.ncsc.gov.uk/news/apt28-exploit-routers-to-enable-dns-hijacking-operations","by":"UK NCSC","date":"2026-04-07"},{"kind":"news","title":"FBI Operation Masquerade Russian GRU router takedown","url":"https://cyberscoop.com/fbi-operation-masquerade-russian-gru-router-takedown-brett-leatherman/","by":"CyberScoop","date":"2026-04-09"},{"kind":"advisory","title":"TP-Link support FAQ for CVE-2023-50224","url":"https://www.tp-link.com/us/support/faq/4308/","by":"TP-Link","date":"2025-09-03"}],"started":"2026-04-07","closed":"2026-04-09","created":"2026-11-03T21:21:04.002Z","updated":"2026-11-03T21:21:04.002Z","cve_notes":[{"cve":"CVE-2023-50224","name":"Authentication bypass in TP-Link TL-WR841N web server","what":"A spoofing flaw in the httpd web service of the TP-Link TL-WR841N router that lets an attacker with network access retrieve stored credentials, which APT28 then used to change the router's DNS settings.","severity":"medium","cvss":6.5}],"timeline":[{"at":"2026-04-09","added":"2026-11-03T21:19:18.455Z","kind":"other","text":"CyberScoop reported the FBI's Operation Masquerade sent commands to compromised routers to restore their DNS settings, cutting off the hackers' access. It reported more than 18,000 TP-Link routers compromised and did not mention any charges.","url":"https://cyberscoop.com/fbi-operation-masquerade-russian-gru-router-takedown-brett-leatherman/","by":"CyberScoop","patch":null},{"at":"2026-04-07","added":"2026-11-03T21:19:18.455Z","kind":"other","text":"The UK NCSC attributed the activity to GRU Unit 26165 with high confidence. It said TP-Link models such as the WR841N, Archer C5/C7 and WDR series were targeted, plus some MikroTik routers in Ukraine.","url":"https://www.ncsc.gov.uk/news/apt28-exploit-routers-to-enable-dns-hijacking-operations","by":"UK NCSC","patch":null},{"at":"2026-04-07","added":"2026-11-03T21:19:18.455Z","kind":"other","text":"Microsoft, which tracks the actor as Forest Blizzard, said more than 200 organisations and about 5,000 consumer devices were affected, with attacks aimed at Outlook on the web sign-ins. Its post names no CVEs.","url":"https://www.microsoft.com/en-us/security/blog/2026/04/07/soho-router-compromise-leads-to-dns-hijacking-and-adversary-in-the-middle-attacks/","by":"Microsoft","patch":null},{"at":"2026-04-07","added":"2026-11-03T21:19:18.455Z","kind":"disclosed","text":"The FBI and partner agencies warned that Russia's GRU unit APT28 had been taking over small-office and home routers, including TP-Link models via CVE-2023-50224, and changing their DNS settings to send users' traffic to attacker-run servers. The FBI and Justice Department said they had recently disrupted the network.","url":"https://www.ic3.gov/PSA/2026/PSA260407","by":"FBI IC3","patch":"partial"}],"url":"https://hard.fyi/live/apt28-router-dns-hijacking-tp-link-apr-2026/","json":"https://hard.fyi/api/live?id=apt28-router-dns-hijacking-tp-link-apr-2026"}