US Thwarts DNS Hijacking Network Controlled by Russian APT28 Hackers
The FBI deployed a method to unplug US-based routers compromised by APT28 from the threat actor’s malicious network
APT28 (Fancy Bear)
Russian military intelligence (GRU) hacking group active since mid-2000s. Known for targeting NATO governments, military organizations, and political entities.
Also known as: apt28, fancy bear, sofacy, pawn storm, strontium, forest blizzard, iron twilight, sednit
AI Intelligence Brief cached
Edit Profile
Entity Relationships
Related YARA Rules View all on YARA Rules page →
90-Day Activity
Last 90 Days (4)
Last 90 Days
All Time
Russian APT28 Hackers Hijack Routers to Steal Credentials, UK Security Agency Warns
Newly identified malicious campaigns are linked to virtual private servers modified by APT28 to operate as malicious DNS servers
Sednit reloaded: Back in the trenches
The resurgence of one of Russia’s most notorious APT groups
January 2026 CVE Landscape: 23 Critical Vulnerabilities Mark 5% Increase, APT28 Exploits Microsoft Office Zero-Day
January 2026 saw 23 actively exploited CVEs, including APT28’s Microsoft Office zero-day and critical auth bypass flaws impacting enterprise systems.