End-of-life routers in homes and small offices hacked in 120 countries.

Ars Technica is known for its  coverage of technology-related news and analysis, ranging from scientific breakthroughs to the latest gadgets and gaming developments. Readers can learn about emerging technologies, industry trends, and the societal impact of technological advancements through detailed articles and reviews.

Ars Technica

Russia's military intelligence unit APT28 (Forest Blizzard/GRU) has compromised between 18,000 and 40,000 consumer routers—primarily MikroTik and TP-Link devices—across 120 countries. The operation uses end-of-life, unpatched routers as proxies to infiltrate foreign ministries, law enforcement, and government agencies. Attackers exploit known vulnerabilities to alter DNS settings and use DHCP to propagate malicious DNS entries to connected workstations, redirecting traffic through adversary-in-the-middle servers to harvest credentials and tokens. Microsoft 365 domains were among the targeted services. The group combines novel tools like an LLM called LAMEHUG with classic attack techniques.

Thousands of consumer routers hacked by Russia’s military

How The Callisto Protocol's Gameplay Was Perfected Months Before Release