GRU DNS Hijacking Campaign Targeting TP-Link SOHO Routers

Historical analysis: this article examines information published by the source on April 07, 2026. Check the latest vendor guidance before acting.

Threat activity

Reports indicate that the Russian GRU Military Unit 26165 (APT28) has targeted TP-Link small office/home office (SOHO) routers by exploiting known vulnerabilities. Since at least 2024, these actors have stolen credentials to gain unauthorized access and manipulated DNS settings to redirect traffic to malicious DNS resolvers controlled by the GRU.

Once control was established, the actors used automated filtering to identify high-interest targets—specifically individuals in government, military, and critical infrastructure sectors. For these targets, the attackers provided fraudulent DNS records mimicking legitimate services, such as Microsoft Outlook Web Access. This enabled Actor-in-the-Middle attacks designed to harvest unencrypted passwords, authentication tokens, emails, and other sensitive data from devices on the same network.

Who may be at risk

Organizations and individuals utilizing TP-Link SOHO routers are at risk, particularly those using hardware that has reached End-of-Life (EoL) or End-of-Support status. While initial targeting was described as indiscriminate, the primary objectives were users within U.S. government, military, and critical infrastructure sectors.

Potential breach-prevention strategy

The reported entry path involved the exploitation of known vulnerabilities to steal credentials and gain unauthorized access to router management interfaces. It remains unknown which specific CVEs were leveraged or the exact sequence of the initial compromise.

Our analysis suggests a similar breach could have been mitigated through the following prioritized actions:

1. Hardware Lifecycle Management: Replace EoL and End-of-Support routers. This addresses the scenario where legacy hardware no longer receives security patches for known vulnerabilities. Responsible Role: Infrastructure Manager. Verification involves auditing hardware versions against manufacturer EoL lists.
2. Firmware Standardization: Ensure all edge devices are updated to the latest available firmware. This could have reduced the likelihood of exploitation via known vulnerabilities. Responsible Role: Network Administrator. Verification requires confirming current firmware versions against the manufacturer’s latest release.
3. Remote Management Restriction: Implement firewall rules to disable or restrict remote management services to trusted internal IPs only. This limits the exposure of the management interface to external actors. Responsible Role: Security Engineer. Verification involves attempting to access the management portal from an external, unauthorized IP address.
4. DNS Integrity Monitoring: Periodically verify that DNS resolver settings match authorized ISP or corporate defaults. This is a detection and recovery control intended to identify if hijacking has already occurred. Responsible Role: Network Administrator. Verification involves comparing active router DNS configurations against known-good baselines.

Defensive priorities

Defenders should prioritize the identification of all TP-Link SOHO assets within their environment. Priority must be given to replacing hardware that is no longer supported by the vendor, as these devices cannot be patched against new or existing vulnerabilities. Following hardware replacement or firmware updates, defenders should review firewall configurations to ensure remote management interfaces are not exposed to the public internet.

Detection and validation

To verify if a device has been compromised or successfully remediated, administrators should manually inspect the router’s DNS resolver settings for unauthorized entries. A factory reset via the hardware button can revert changes made by attackers, but this does not address the underlying vulnerability that allowed access.

Validation of remediation requires more than a version check; it necessitates confirming that:
1. The firmware is current.
2. Remote management is disabled or restricted.
3. DNS resolvers are authenticated and legitimate.

Residual risk remains for devices where vulnerabilities persist in the latest firmware or where administrative credentials have been compromised and not rotated.

What remains unknown

The specific known vulnerabilities exploited by APT28 have not been detailed. Additionally, it is unclear if the attackers established persistence mechanisms beyond DNS manipulation that would survive a firmware update or factory reset.

Source and editorial note

Justice Department Conducts Court-Authorized Disruption of DNS Hijacking Network Controlled by a Russian Military Intelligence Unit · Source date: April 07, 2026 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: April 10, 2026. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 15, 2026 at 00:34 UTC.

Request a Vulnerability Assessment