Russian GRU hackers hijack TP-Link and other home routers to steal logins (CVE-2023-50224)
Russia's APT28 hijacked home and small-office routers, mainly TP-Link, to redirect traffic and steal passwords and tokens. The FBI reset many routers, but replace end-of-life routers, update firmware, change default logins and switch off remote management.
Replace any TP-Link TL-WR841N or other end-of-support router, as TP-Link lists the WR841N as possibly no longer supported. Update firmware on other routers, change default admin passwords, turn off remote management, and treat browser certificate warnings as a stop sign.
- TP-Link TL-WR841Nno fixed version yet
What’s happening
The FBI, UK NCSC, Microsoft and partner agencies reported on 7 April 2026 that Russia's military intelligence unit APT28 (also called Fancy Bear or Forest Blizzard) had taken over small-office and home routers. The attackers changed the routers' DNS settings so connected phones and laptops used attacker-run servers, which returned false answers for services such as Outlook on the web. The FBI and NCSC say TP-Link routers were compromised using CVE-2023-50224, an authentication flaw in the TL-WR841N that leaks stored credentials. The NCSC also named MikroTik routers in a second cluster. Microsoft counted more than 200 organisations and about 5,000 consumer devices affected; CyberScoop reported more than 18,000 compromised TP-Link routers, so counts differ between sources. The FBI said it had disrupted the network, and CyberScoop reported it sent commands to restore the routers' DNS settings. TP-Link's advisory says the TL-WR841N may be end-of-life, and CISA's catalogue tells users to stop using affected products. No charges were reported in the sources read.
- What
- Flaw
- Affects
- TP-Link TL-WR841N and other home and small-office routers (TP-Link, MikroTik)
- Affected
- TP-Link TL-WR841N (CISA lists firmware below 12.0 as affected)
Other TP-Link small-office and home routers named by NCSC: Archer C5/C7, WDR series
Some MikroTik routers in a second cluster (NCSC) - Fixed in
- No fix yet
- Since
- 7 Apr 2026
- Closed
- 9 Apr 2026
Timeline
- Update
CyberScoop reported the FBI's Operation Masquerade sent commands to compromised routers to restore their DNS settings, cutting off the hackers' access. It reported more than 18,000 TP-Link routers compromised and did not mention any charges.
- Update
The UK NCSC attributed the activity to GRU Unit 26165 with high confidence. It said TP-Link models such as the WR841N, Archer C5/C7 and WDR series were targeted, plus some MikroTik routers in Ukraine.
- Update
Microsoft, which tracks the actor as Forest Blizzard, said more than 200 organisations and about 5,000 consumer devices were affected, with attacks aimed at Outlook on the web sign-ins. Its post names no CVEs.
- Made publicPartly fixed
The FBI and partner agencies warned that Russia's GRU unit APT28 had been taking over small-office and home routers, including TP-Link models via CVE-2023-50224, and changing their DNS settings to send users' traffic to attacker-run servers. The FBI and Justice Department said they had recently disrupted the network.
Sources
- Russian GRU hackers exploit routers (FBI PSA I-040726)FBI IC3 · 7 Apr 2026
- SOHO router compromise leads to DNS hijacking and adversary-in-the-middle attacksMicrosoft · 7 Apr 2026
- APT28 exploit routers to enable DNS hijacking operationsUK NCSC · 7 Apr 2026
- FBI Operation Masquerade Russian GRU router takedownCyberScoop · 9 Apr 2026
- TP-Link support FAQ for CVE-2023-50224TP-Link · 3 Sept 2025