Key Takeaways
- A GRU‑linked hacking group (APT28/Fancy Bear) used DNS hijacking to turn thousands of outdated SOHO routers into espionage relays across 23 U.S. states.
- The attack focused on enterprise‑grade devices, but many of the compromised TP‑Link models can also serve as home routers, so users should verify whether their model appears on the affected list.
- Immediate defenses include replacing end‑of‑life routers, keeping firmware current, changing default admin credentials, disabling remote management, and using a VPN for sensitive traffic.
- Regular weekly reboots help remove any implanted malware, and strong, unique passwords (both for router login and Wi‑Fi) are essential.
- Ongoing vigilance—monitoring vendor security advisories and applying patches promptly—remains the best long‑term strategy against similar nation‑state router exploits.
Overview of the GRU Router Espionage Campaign
For years, a unit inside Russia’s military intelligence agency (the GRU) quietly converted ordinary home and small‑office routers into tools for espionage. The group, known as APT28, Fancy Bear, or Forest Blizzard—the same actors behind the 2016 DNC breach—exploited unpatched firmware and unchanged default passwords to compromise thousands of devices across 23 U.S. states. By altering the routers’ DNS settings, attackers redirected internet traffic through servers under Russian control, harvesting credentials and enabling persistent, passive reconnaissance on military, government, and critical‑infrastructure targets. Federal agents disrupted the operation in April under a court order, but fixing the underlying vulnerabilities requires action from device owners.
Technical Mechanics: DNS Hijacking Explained
The core technique employed in this campaign is DNS hijacking. Attackers gain administrative access to a router and change its Domain Name System (DNS) configuration so that all DNS queries are sent to malicious servers controlled by the GRU. When a user attempts to visit a legitimate website, the rogue DNS server returns an IP address that points to a server under attacker control, allowing the hackers to see unencrypted traffic, inject malicious content, or harvest login credentials. Because DNS is a foundational internet service, compromising it provides threat actors with a stealthy way to monitor and manipulate communications at scale without needing to infect each endpoint individually.
Scope and Targets: Who Was Affected
The FBI’s announcement notes that the operation indiscriminately targeted a wide pool of routers, aiming to collect information on military, government, and critical‑infrastructure entities. Microsoft Threat Intelligence identified more than 200 organizations and roughly 5,000 consumer devices impacted by the GRU’s activity. While the primary focus was enterprise‑grade hardware, many of the listed models are also sold for home use, meaning that residential networks could inadvertently become part of the espionage infrastructure if those devices remain unpatched.
List of Compromised TP‑Link Models
The UK’s National Cyber Security Centre (NCSC) published a list of TP‑Link routers known to have been exploited, emphasizing that the list is likely not exhaustive. Affected models include:
- TP‑Link LTE Wireless N Router MR6400
- TP‑Link Wireless Dual Band Gigabit Router Archer C5
- TP‑Link Wireless Dual Band Gigabit Router Archer C7
- TP‑Link Wireless Dual Band Gigabit Router WDR3600
- TP‑Link Wireless Dual Band Gigabit Router WDR4300
- TP‑Link Wireless Dual Band Router WDR3500
- TP‑Link Wireless Lite N Router WR740N (and variants WR740N/WR741ND, WR749N)
- TP‑Link Wireless N 3G/4G Router MR3420
- TP‑Link Wireless N Access Point WA801ND and WA901ND
- TP‑Link Wireless N Gigabit Router WR1043ND and WR1045ND
- TP‑Link Wireless N Router WR840N, WR841HP, WR841N, WR841N/WR841ND, WR842N, WR842ND, WR845N, WR941ND, WR945NA
All of these devices have reached End of Service (EOS) and End of Life (EOL) status, meaning they no longer receive routine security updates from the manufacturer.
Vendor Response and End‑of‑Life Status
A TP‑Link spokesperson told CNET that the impacted models are outside the company’s standard maintenance lifecycle. Nevertheless, TP‑Link has released security updates for select legacy models where technically feasible and urges owners of these outdated routers to upgrade to newer devices if possible. The company points users to its security advisory page, which hosts the available patches addressing the recent GRU campaign. For routers that cannot be patched, replacement is the only reliable mitigation.
Why Home Users Should Still Pay Attention
Although the operation chiefly targeted enterprise routers, the overlap between business‑grade and consumer models means that some home networks are vulnerable. Many of the listed TP‑Link devices are commonly used in residential settings, especially in older or budget‑friendly installations. If a home router is compromised, attackers could use it as a pivot point to monitor household traffic, steal personal credentials, or launch further attacks against connected devices. Therefore, even if you are not a direct target of the GRU’s intelligence gathering, maintaining router hygiene protects both personal privacy and the broader internet ecosystem.
Immediate Mitigation: Upgrade or Replace
The most effective step is to replace any router that appears on the affected list with a model still receiving vendor support. Older devices that have reached EOS/EOL lack the firmware updates needed to close known vulnerabilities, leaving them permanently exposed. When selecting a replacement, look for routers that offer automatic firmware updates, strong default security settings, and a clear end‑of‑life policy from the manufacturer. Investing in a modern, supported router not only closes the current DNS‑hijacking vector but also improves overall network performance and security.
Firmware Management and Automatic Updates
For routers that remain in service, enabling automatic firmware updates is crucial. Many modern routers include a setting in their web‑based admin interface or companion app that periodically checks the manufacturer’s server for new releases and installs them without user intervention. If automatic updates are unavailable, owners should manually check for updates at least once a month, applying any patches promptly. Keeping firmware current ensures that known exploits—such as those used by APT28 to alter DNS settings—are patched before attackers can leverage them.
Credential Hygiene: Changing Defaults and Wi‑Fi Passwords
One of the easiest ways for threat actors to gain router access is by exploiting default admin usernames and passwords. Users should immediately change these credentials to something long, random, and unique—ideally a passphrase of at least 12 characters that mixes letters, numbers, and symbols. The router’s admin login is separate from the Wi‑Fi network password; both should be updated regularly (every six months is a good baseline) and never reused across other accounts. Strong credentials dramatically reduce the likelihood of a brute‑force or credential‑stuffing attack succeeding.
Additional Hardening: Disable Remote Management and Use VPN
Disabling remote management (often labeled “Remote Access,” “WAN Administration,” or similar) prevents attackers from altering router settings from outside the local network—a capability the GRU abused to persistently manipulate DNS configurations. Most home users do not need this feature, so turning it off eliminates a significant attack surface. Finally, the FBI’s guidance recommends employing a Virtual Private Network (VPN) for any remote work or when accessing sensitive data. A VPN encrypts traffic between the user’s device and the VPN server, rendering intercepted DNS queries or traffic unreadable to eavesdroppers, even if the router itself is compromised.
Conclusion and Ongoing Vigilance
The GRU’s DNS‑hijacking router campaign underscores how aging networking equipment can become a strategic liability in nation‑state cyber operations. While the disruption effort halted the immediate threat, the underlying vulnerability persists in any device running outdated firmware or default credentials. By following the outlined steps—upgrading end‑of‑life hardware, keeping firmware current, strengthening authentication, disabling unnecessary remote features, and using VPNs for sensitive communications—users can significantly reduce their exposure. Continuous monitoring of vendor security advisories and a habit of regular router maintenance will remain essential defenses against similar exploits in the future.