#apt28 tag - Briefly

Privacy professionals

Britons warned about Russian hackers targeting internet routers for espionage

Information security

US Disrupts Russian Espionage Operation Involving Hacked Routers and DNS Hijacking

Russian cyber spies targeting consumer, Soho routers | Computer Weekly

Russian cyber intelligence services conducted a DNS hijacking campaign targeting vulnerable broadband routers to steal data from victims.

Russia's APT28 behind latest wave of router, DNS attacks

Russia's APT28 group is exploiting vulnerabilities in routers to steal passwords and redirect users to malicious websites.

US politics

UK uncovers novel Microsoft snooping malware, blames GRU

Russia's APT28 has deployed new malware to harvest Microsoft email credentials and access compromised accounts.

fromArs Technica

Thousands of consumer routers hacked by Russia's military

Russian military hackers are exploiting consumer routers to harvest passwords and credentials for espionage, affecting thousands of devices globally.

Privacy professionals

fromwww.theguardian.com

Britons warned about Russian hackers targeting internet routers for espionage

Russian hackers exploit internet routers for espionage, targeting users' credentials and devices on home networks.

US Disrupts Russian Espionage Operation Involving Hacked Routers and DNS Hijacking

The US disrupted a Russian espionage operation using hacked SOHO routers to capture sensitive data from victims.

Russian cyber spies targeting consumer, Soho routers | Computer Weekly

Russian cyber intelligence services conducted a DNS hijacking campaign targeting vulnerable broadband routers to steal data from victims.

Russia's APT28 behind latest wave of router, DNS attacks

Russia's APT28 group is exploiting vulnerabilities in routers to steal passwords and redirect users to malicious websites.

US politics

UK uncovers novel Microsoft snooping malware, blames GRU

Russian State-Linked APT28 Exploits SOHO Routers in Global DNS Hijacking Campaign

APT28 has launched a campaign exploiting MikroTik and TP-Link routers for cyber espionage, compromising DNS settings to capture credentials since May 2025.

1 month ago

APT28 Uses BEARDSHELL and COVENANT Malware to Spy on Ukrainian Military

APT28, a Russian state-sponsored hacking group, has deployed BEARDSHELL and COVENANT malware since April 2024 to conduct long-term surveillance of Ukrainian military personnel.

1 month ago

APT28-Linked Campaign Deploys BadPaw Loader and MeowMeow Backdoor in Ukraine

Russian state-sponsored APT28 deployed two new malware families, BadPaw and MeowMeow, targeting Ukrainian entities through phishing emails with Ukrainian-language lures about border crossing appeals.

1 month ago

APT28 Tied to CVE-2026-21513 MSHTML 0-Day Exploited Before Feb 2026 Patch Tuesday

Microsoft patched CVE-2026-21513, a high-severity MSHTML Framework vulnerability exploited as a zero-day by Russia-linked APT28, allowing attackers to bypass security features and achieve code execution through malicious files.

#cve-2026-21509

Information security

The world's default productivity tool is becoming a national security liability | Computer Weekly

Information security

Russia's APT28 Rapidly Weaponizes Newly Patched Office Vulnerability

Information security

The world's default productivity tool is becoming a national security liability | Computer Weekly

Information security

Russia's APT28 Rapidly Weaponizes Newly Patched Office Vulnerability

Russian APT28 Runs Credential-Stealing Campaign Targeting Energy and Policy Organizations

APT28 (BlueDelta) conducted targeted credential-harvesting phishing campaigns against Turkish energy/nuclear contacts, European think tank staff, and organizations in North Macedonia and Uzbekistan.

#phishing

4 months ago

Information security

APT28 Targets Ukrainian UKR-net Users in Long-Running Credential Phishing Campaign

Privacy professionals

CERT-UA Discovers LAMEHUG Malware Linked to APT28, Using LLM for Phishing Campaign

4 months ago

Information security

APT28 Targets Ukrainian UKR-net Users in Long-Running Credential Phishing Campaign

Privacy professionals

CERT-UA Discovers LAMEHUG Malware Linked to APT28, Using LLM for Phishing Campaign

French Ministry of the Interior hacked, unclear if any data was stolen

The French Interior Ministry suffered a cyberattack compromising email servers and some document files; authorities launched an investigation and tightened security while origins are examined.

fromSecuritymagazine

7 months ago

Russian Threat Group Targets Microsoft Outlook With Malware

"APT28 is abusing Outlook as a covert channel through a VBA macro backdoor named NotDoor," Jason Soroko, Senior Fellow at Sectigo, explains. "Delivery uses DLL sideloading of a malicious SSPICLI.dll by the signed OneDrive.exe to disable macro protections and stage commands. The macro watches inbound mail for a trigger word and can exfiltrate data upload files and run commands. This blends with trusted binaries and normal mail flow and can slip past perimeter tools and basic detections."

Information security