-c439b7bd9030ecf9d5a4287dc361ba31.jpg "Photo of Katherina Popilnichenko")
The UK National Cyber Security Centre (NCSC) has issued a warning regarding a significant data theft threat posed by a Russian hacking group exploiting router vulnerabilities on April 7.
We bring you stories from the ground. Your support keeps our team in the field.
The NCSC reports that the Russian hacking group APT28, also known as Fancy Bear, is targeting these vulnerabilities.
According to the UK National Cyber Security Centre, this group, which is believed to be supported by Russian military intelligence, uses the exploits to gain control over devices and steal passwords and other authorization data.
By interfering with network settings, the hackers can "rewrite" configurations for the Dynamic Host Configuration Protocol (DHCP) and Domain Name System (DNS).
This allows them to redirect internet traffic through DNS servers they control, ultimately enabling the collection of sensitive data from users on that connection.
The hackers likely act indiscriminately, initially "casting a wide net" over a broad range of potential victims. They then identify and target specific users where they see the highest potential gain or value.
The warning provides a detailed description of how previous router breaches occurred and offers a list of recommendations to help users reduce risks to their own networks.
Previously, an international investigation revealed that Romania was a major target in a cyber-espionage campaign.
The operation, attributed to the previously mentioned group APT28 (Fancy Bear), focused on exploiting vulnerabilities in surveillance cameras. By using spear-phishing emails and malware, the hackers gained access to critical data, allowing them to observe strategic sites such as border crossings and ports in real time.
-9a7b3a98ed5c506e0b77a6663f5727c5.png)
