Russian Hackers Compromise Thousands of Home and Small Business Routers to Steal Login Credentials

Wed, 08 Apr 2026 07:04:00 +0200

A coordinated cyberattack by Russian government-linked hackers targeted thousands of home and small business routers worldwide, allowing the group to steal passwords and access tokens from unsuspecting users. The campaign primarily exploited unpatched vulnerabilities in MikroTik and TP-Link devices, which had outdated software, leaving them exposed to remote attacks. According to the U.K.'s National Cyber Security Centre (NCSC) and Black Lotus Labs, this operation enabled the hackers to intercept internet traffic, redirect users to spoofed websites, and obtain login credentials without triggering two-factor authentication protections. The campaign, attributed to Fancy Bear, affected at least 18,000 victims across roughly 120 countries, including government offices, law enforcement agencies, and email providers in North Africa, Central America, and Southeast Asia. Microsoft reported that over 5,000 consumer devices and more than 200 organizations were impacted, including at least three