Fancy Bear Turns Your Router Into a Spy
By: Jim Stickley and Tina Davis
June 29, 2026
Your router may not store family photos, financial records, or work documents, but that doesn't mean hackers aren't interested in it.
Security researchers and government agencies recently warned that the Russian state-sponsored hacking group Fancy Bear (aka APT 28) has been actively targeting vulnerable TP-Link routers around the world. The goal isn't necessarily to gain access to the router itself. The goal is to steal what passes through it: Primarily banking credentials.
Step One
The attackers look for TP-Link routers running outdated software or known vulnerabilities. Once they gain access, they modify the router's DNS settings. Think of DNS as the internet's phone book. It tells your device where to go when you type a website address.
Step Two
After changing those settings, the hackers can secretly redirect internet traffic through systems they control. In some cases, victims attempting to visit legitimate services such as email platforms can be routed through malicious infrastructure that captures usernames, passwords, authentication tokens, and other sensitive information. The scary part? Everything may appear completely normal to the user.
Keeping On The Safe Side
So how do you avoid becoming part of a foreign espionage campaign?
- Check your router for firmware updates and install them promptly.
- Replace older routers that are no longer supported by the manufacturer. Unsupported devices often become easy targets.
- Change default administrator passwords immediately after installing a new device and use strong, unique credentials for router access.
- Enable multi-factor authentication on important accounts. Even if credentials are stolen, MFA can help stop attackers from getting in.
- Disable remote management features unless you absolutely need them.
There is some suspicion that the attack may also install malware on the devices.
Your router may be out of sight, but it shouldn't be out of mind. Cybercriminals and nation-state hackers know that the easiest way to watch your traffic is often through the device directing it. Make sure that little box in the corner is working for you, not for Fancy Bear.
SUBSCRIBE TO WEEKLY NEWSLETTER
