Recent reports indicate that the Russian military has resumed large-scale hacking campaigns targeting home and small office routers, unknowingly redirecting users to malicious sites that collect passwords and credential tokens for espionage purposes. This alarming activity was highlighted by researchers from Lumen Technologies’ Black Lotus Labs on Tuesday.
Estimates suggest that between 18,000 and 40,000 consumer routers, primarily from MikroTik and TP-Link manufacturers, have been compromised across approximately 120 countries. These devices have been integrated into the infrastructure of APT28, a sophisticated threat group linked to Russia’s military intelligence agency, the GRU. APT28, which has been active for at least 20 years, is known for executing numerous significant attacks against government entities globally and has been identified by several names, including Pawn Storm, Sofacy Group, and Tsar Team.
Advanced Tactics and Techniques
A small cluster of compromised routers served as proxies, allowing APT28 to access a wider array of routers belonging to foreign ministries and law enforcement bodies. This strategic maneuver enabled the attackers to alter DNS settings for selected websites, including key domains associated with Microsoft’s 365 services, thereby facilitating their surveillance objectives.
The Black Lotus researchers noted that APT28 remains adept at fusing cutting-edge technologies, such as the large language model ‘LAMEHUG,’ with long-established attack methods. Their ongoing campaigns demonstrate both technological prowess and a persistence in utilizing conventional tactics, even after being publicly exposed, thus posing a continuous threat to organizations worldwide.
The attackers leveraged vulnerabilities inherent in older router models that had not received security patches. By modifying DNS settings for targeted domains and employing the Dynamic Host Configuration Protocol to propagate these settings to connected workstations, APT28 could manipulate user traffic. This allowed traffic to be rerouted through nefarious servers before reaching legitimate destinations.
In terms of the tactics and techniques employed, this attack exemplifies several phases outlined in the MITRE ATT&CK framework. Initial access may have been achieved through the exploitation of unpatched devices, while persistence was likely established through the ongoing manipulation of DNS settings. Additionally, privilege escalation techniques could have enabled the attackers to broaden their access to sensitive environments, reinforcing the need for vigilance in network security practices.
As these developments unfold, the implications for business owners are significant. Organizations must remain proactive in their cybersecurity measures, particularly concerning the maintenance of network hardware and awareness of potential vulnerabilities. The growing sophistication of cyber threats necessitates a robust approach to safeguarding sensitive information and interrupting adversarial attempts at espionage.