A group of Russian government hackers has compromised thousands of home and small business routers globally to redirect internet traffic, aiming to steal passwords and access tokens, according to security researchers and government agencies. The hacking group, identified as Fancy Bear, exploited vulnerabilities in unpatched MikroTik and TP-Link routers, as reported by the U.K.’s National Cyber Security Centre and Lumen’s Black Lotus Labs. Over several years, these hackers surveilled numerous individuals, many of whom were unaware of the compromised security of their outdated devices. The campaign has affected at least 18,000 victims across 120 countries, including government and law enforcement entities in regions such as North Africa and Southeast Asia. In response, the U.S. Justice Department has taken measures to neutralize affected routers domestically to prevent further exploitation.
Why It Matters
This incident highlights the ongoing threat posed by state-sponsored cyberattacks, particularly targeting vulnerable consumer devices. The use of compromised routers to redirect internet traffic underscores the risks associated with unpatched technology, which can lead to significant breaches of personal and organizational data. Cybersecurity experts have previously noted that such attacks can facilitate identity theft and espionage, affecting both individuals and national security. As cyber threats continue to evolve, the need for robust cybersecurity measures and public awareness becomes increasingly critical to protect against similar future incidents.
Want More Context? 🔎
