Skip to content
OriginalSign in
Image: dti.domaintools.com

dti.domaintools.comdti.domaintools.com

GRU hackers use compromised routers to spy on UK officials

Part of the APT28 story · since 3 Sep 2025

Quiet for 11 dayslast report 22 Oct61 articles15 outlets
3 Sep · Dark Reading first3 Apr14 Jun25 AugNowThis article54th of 61
  • Wed 3 Sep, 22:09 UTC. Dark Reading, first report. Russia's APT28 Targets Microsoft Outlook With 'NotDoor' Malware.
  • Thu 4 Sep, 18:30 UTC. The Hacker News, its first report on the story. Russian APT28 Deploys “NotDoor” Outlook Backdoor Against Companies in NATO Countries.
  • Fri 5 Sep, 01:00 UTC. SecurityOnline, its first report on the story. NotDoor: A New Backdoor by Russia’s APT28 Is Hiding in Microsoft Outlook Macros.
  • Wed 10 Sep, 01:46 UTC. SecurityOnline. GONEPOSTAL: New Outlook Backdoor by Russia’s APT28 Uses Email for C2.
  • Tue 16 Sep, 13:08 UTC. GBHackers, its first report on the story. APT28 Exploits Signal Messenger to Deploy eardShell and Covenant Malware.
  • Wed 17 Sep, 02:25 UTC. SecurityOnline. APT28’s BeardShell Campaign: Steganography, Cloud Abuse, and Persistent Espionage.
  • Fri 17 Oct, 09:00 UTC. GBHackers. APT28 Deploys BeardShell and Covenant Modules via Weaponized Office Documents.
  • Thu 6 Nov, 03:15 UTC. SecurityOnline. Next-Gen Threat: Google Exposes AI-Enabled Malware That Rewrites Its Own Code with Gemini LLM.
  • Wed 17 Dec, 15:50 UTC. The Hacker News. APT28 Targets Ukrainian UKR-net Users in Long-Running Credential Phishing Campaign.
  • Mon 22 Dec, 00:41 UTC. SecurityOnline. The GRU’s Silent Shift: How BlueDelta Hijacks Ukrainian Webmail Using ngrok and Mocky.
  • Fri 9 Jan, 01:40 UTC. SecurityOnline. BlueDelta Espionage: Russian Hackers Abuse Free Apps to Target Energy Sector.
  • Fri 9 Jan, 16:36 UTC. The Hacker News. Russian APT28 Runs Credential-Stealing Campaign Targeting Energy and Policy Organizations.
  • Mon 12 Jan, 10:30 UTC. Security Affairs, its first report on the story. Credential-harvesting attacks by APT28 hit Turkish, European, and Central Asian organizations.
  • Mon 12 Jan, 12:50 UTC. SecurityWeek, its first report on the story. Russia’s APT28 Targeting Energy Research, Defense Collaboration Entities.
  • Tue 20 Jan, 13:16 UTC. SOCRadar, its first report on the story. Dark Web Profile: APT28.
  • Tue 3 Feb, 03:15 UTC. SecurityOnline. Fancy Bear Returns: APT28 Exploits Office Flaw in “Operation Neusploit”. Cites a CVE in CISA KEV.
  • Tue 3 Feb, 10:00 UTC. The Hacker News. APT28 Uses Microsoft Office CVE-2026-21509 in Espionage-Focused Malware Attacks. Cites a CVE in CISA KEV.
  • Tue 3 Feb, 11:40 UTC. SecurityWeek. Russia’s APT28 Rapidly Weaponizes Newly Patched Office Vulnerability. Cites a CVE in CISA KEV.
  • Tue 3 Feb, 11:40 UTC. SOCRadar. CVE-2026-21509: APT28 Actively Exploits Microsoft Office Vulnerability in Ukraine. Cites a CVE in CISA KEV.
  • Tue 3 Feb, 12:45 UTC. Security Affairs. APT28 exploits Microsoft Office flaw in Operation Neusploit. Cites a CVE in CISA KEV.
  • Mon 9 Feb, 00:40 UTC. SecurityOnline. APT28 Weaponizes Office Flaw to Spy on NATO & Military. Cites a CVE in CISA KEV.
  • Mon 23 Feb, 21:31 UTC. The Hacker News. Russia linked APT28 uses MacroMaze document beacons to breach PCs.
  • Tue 24 Feb, 09:35 UTC. Security Affairs. Russia's APT28 runs MacroMaze webhook macros to steal data.
  • Mon 2 Mar, 11:39 UTC. The Hacker News. MSHTML CVE-2026-21513 exploited by APT28; patch issued. Cites a CVE in CISA KEV.
  • Mon 2 Mar, 15:44 UTC. Security Affairs. APT28 exploits MSHTML CVE-2026-21513 to run code via LNK. Cites a CVE in CISA KEV.
  • Thu 5 Mar, 11:27 UTC. The Hacker News. APT28 targets Ukraine with BadPaw and MeowMeow via phishing HTA.
  • Thu 5 Mar, 15:35 UTC. Security Affairs. Phishing delivers BadPaw loader and MeowMeow backdoor; APT28 link.
  • Tue 10 Mar, 12:22 UTC. The Hacker News. APT28 Deploys BEARDSHELL and COVENANT to spy on Ukrainian military.
  • Tue 10 Mar, 15:58 UTC. Security Affairs. APT28 conducts long-term espionage on Ukrainian forces using custom malware.
  • Tue 10 Mar, 20:31 UTC. Dark Reading. Russian Threat Actor Sednit Resurfaces With Sophisticated Toolkit.
  • Thu 19 Mar, 15:35 UTC. DataBreaches, its first report on the story. Russian hackers exploit Zimbra flaw in Ukrainian govt attacks. Cites a CVE in CISA KEV.
  • Thu 26 Mar, 03:45 UTC. trendmicro.com, its first report on the story. Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure Entities. Cites a CVE in CISA KEV.
  • Tue 7 Apr, 13:30 UTC. NCSC, its first report on the story. APT28 exploits routers to redirect DNS, stealing credentials.
  • Tue 7 Apr, 13:31 UTC. NCSC. NCSC Warns Russian APT28 Hijacks Routers for DNS Attacks.
  • Tue 7 Apr, 15:27 UTC. Microsoft, its first report on the story. Forest Blizzard hijacks routers to spy via AI enabled DNS attacks.
  • Tue 7 Apr, 16:01 UTC. Infosecurity, its first report on the story. APT28 exploits SOHO routers via CVE‑2023‑50224 to steal credentials. Cites a CVE in CISA KEV.
  • Tue 7 Apr, 18:11 UTC. The Hacker News. APT28 hijacks routers worldwide in DNS based FrostArmada campaign. Cites a CVE in CISA KEV.
  • Wed 8 Apr, 10:30 UTC. Infosecurity. US and FBI shut down Russian hackers' router hijacking network.
  • Wed 8 Apr, 11:00 UTC. SecurityWeek. US Disrupts Russian Espionage Operation Involving Hacked Routers and DNS Hijacking.
  • Wed 8 Apr, 11:31 UTC. Ars Technica, its first report on the story. Russian APT28 hijacks home routers to steal credentials.
  • Wed 8 Apr, 12:41 UTC. DataBreaches. APT28 hijacks routers worldwide to steal passwords via DNS attack.
  • Wed 8 Apr, 13:51 UTC. Malwarebytes, its first report on the story. UK warns Russian hackers hijack home routers for spying.
  • Wed 8 Apr, 16:11 UTC. The Hacker News. APT28 Deploys New PRISMEX Malware Against Ukraine and NATO Allies. Cites a CVE in CISA KEV.
  • Wed 8 Apr, 21:11 UTC. Security Affairs. Russia-linked APT28 uses PRISMEX to infiltrate Ukraine and allied infrastructure with advanced tactics. Cites a CVE in CISA KEV.
  • Thu 9 Apr, 01:31 UTC. Dark Reading. APT28's Year Long Router Hijacking Campaign Exposes World Traffic.
  • Thu 9 Apr, 21:31 UTC. Dark Reading. Trend Micro Exposes Fancy Bears Prismex Malware Targeting Ukraine. Cites a CVE in CISA KEV.
  • Mon 27 Apr, 13:41 UTC. SecurityWeek. APT28 exploits Windows SmartScreen gap for zero click LNK attacks. Cites a CVE in CISA KEV.
  • Tue 28 Apr, 07:21 UTC. The Hacker News. Microsoft Warns of Active Exploit in CVE-2026-32202 Spoof Flaw. Cites a CVE in CISA KEV.
  • Wed 29 Apr, 09:11 UTC. The Hacker News. CISA Flags Actively Exploited CVE-2024-1708 and Windows Flaw. Cites a CVE in CISA KEV.
  • Mon 4 May, 15:31 UTC. SOCRadar. AI Powered Scams Rise as Deepfake Calls Cost Firms Millions.
  • Tue 5 May, 02:31 UTC. Infosecurity. US defence contractors warned of nation state edge device attacks.
  • Fri 8 May, 19:31 UTC. Security Affairs. Polish water plants breached by Russian APT via weak passwords.
  • Mon 8 Jun, 08:59 UTC. SecurityOnline. APT28’s PixyNetLoader uses PNG steganography to hide malware.
  • Tue 16 Jun, 21:31 UTC. dti.domaintools.com, its first report on the story. GRU hackers use compromised routers to spy on UK officials. This article, 54th of 61.
  • Sun 26 Jul, 14:08 UTC. Security Affairs. Hotel WiFi attacks hijack Microsoft 365 logins, linked to APT28.
  • Thu 27 Aug, 20:46 UTC. dti.domaintools.com. Leak shows Moscow university training cyber troops for Russia.
  • Fri 28 Aug, 09:06 UTC. The Hacker News. APT28 Uses HOOKEDGE Backdoor to Spy on European Govt Networks.
  • Fri 28 Aug, 12:29 UTC. Security Affairs. BlueDelta APT deploys HOOKEDGE backdoor via malicious Word macros.
  • Wed 2 Sep, 08:28 UTC. SecurityOnline. HOOKEDGE Malware: BlueDelta Hits EU Diplomatic Targets. Cites a CVE in CISA KEV.
  • Tue 20 Oct, 12:31 UTC. The Hacker News. APT28 Breaches NATO Naval Shipbuilder and Steals Credentials in Week-Long Intrusion. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 09:22 UTC. SecurityOnline. Fancy Bear Used Webhook.site to Breach European Defence Targets.

The report outlines an ongoing Russian cyber operation, primarily by GRU-linked APT28/Fancy Bear, focusing on intelligence gathering through compromised routers and messaging platforms. Key findings include the manipulation of SOHO routers for DNS hijacking, allowing passive monitoring of traffic without deploying malware. Additionally, phishing attacks target commercial messaging applications like Signal, WhatsApp, and Microsoft 365, aiming to access conversations, contacts, and sensitive communications.

The report emphasizes the strategic targeting of high-value entities including government officials, military personnel, and journalists, signaling a shift from disruptive tactics to persistent intelligence collection. Recommendations for organizations include securing network infrastructure and enforcing strict hygiene for messaging platforms to mitigate risks.

How the story developed

All 61 articles
Quiet for 11 dayslast report 22 Oct61 articles15 outlets

61 articles from 15 outlets since 3 Sep. Quiet since 22 Oct. This was the 54th report, 286 days after the first.

Now3 Sep241893125191552825191122519First reportDark Reading · 3 Sep, 22:09This article54th of 61 · day 286NCSC alert7 Apr, 13:30 · official
  • Wed 3 Sep, 22:09 UTC. Dark Reading, first report. Russia's APT28 Targets Microsoft Outlook With 'NotDoor' Malware.
  • Thu 4 Sep, 18:30 UTC. The Hacker News, its first report on the story. Russian APT28 Deploys “NotDoor” Outlook Backdoor Against Companies in NATO Countries.
  • Fri 5 Sep, 01:00 UTC. SecurityOnline, its first report on the story. NotDoor: A New Backdoor by Russia’s APT28 Is Hiding in Microsoft Outlook Macros.
  • Wed 10 Sep, 01:46 UTC. SecurityOnline. GONEPOSTAL: New Outlook Backdoor by Russia’s APT28 Uses Email for C2.
  • Tue 16 Sep, 13:08 UTC. GBHackers, its first report on the story. APT28 Exploits Signal Messenger to Deploy eardShell and Covenant Malware.
  • Wed 17 Sep, 02:25 UTC. SecurityOnline. APT28’s BeardShell Campaign: Steganography, Cloud Abuse, and Persistent Espionage.
  • Fri 17 Oct, 09:00 UTC. GBHackers. APT28 Deploys BeardShell and Covenant Modules via Weaponized Office Documents.
  • Thu 6 Nov, 03:15 UTC. SecurityOnline. Next-Gen Threat: Google Exposes AI-Enabled Malware That Rewrites Its Own Code with Gemini LLM.
  • Wed 17 Dec, 15:50 UTC. The Hacker News. APT28 Targets Ukrainian UKR-net Users in Long-Running Credential Phishing Campaign.
  • Mon 22 Dec, 00:41 UTC. SecurityOnline. The GRU’s Silent Shift: How BlueDelta Hijacks Ukrainian Webmail Using ngrok and Mocky.
  • Fri 9 Jan, 01:40 UTC. SecurityOnline. BlueDelta Espionage: Russian Hackers Abuse Free Apps to Target Energy Sector.
  • Fri 9 Jan, 16:36 UTC. The Hacker News. Russian APT28 Runs Credential-Stealing Campaign Targeting Energy and Policy Organizations.
  • Mon 12 Jan, 10:30 UTC. Security Affairs, its first report on the story. Credential-harvesting attacks by APT28 hit Turkish, European, and Central Asian organizations.
  • Mon 12 Jan, 12:50 UTC. SecurityWeek, its first report on the story. Russia’s APT28 Targeting Energy Research, Defense Collaboration Entities.
  • Tue 20 Jan, 13:16 UTC. SOCRadar, its first report on the story. Dark Web Profile: APT28.
  • Tue 3 Feb, 03:15 UTC. SecurityOnline. Fancy Bear Returns: APT28 Exploits Office Flaw in “Operation Neusploit”. Cites a CVE in CISA KEV.
  • Tue 3 Feb, 10:00 UTC. The Hacker News. APT28 Uses Microsoft Office CVE-2026-21509 in Espionage-Focused Malware Attacks. Cites a CVE in CISA KEV.
  • Tue 3 Feb, 11:40 UTC. SecurityWeek. Russia’s APT28 Rapidly Weaponizes Newly Patched Office Vulnerability. Cites a CVE in CISA KEV.
  • Tue 3 Feb, 11:40 UTC. SOCRadar. CVE-2026-21509: APT28 Actively Exploits Microsoft Office Vulnerability in Ukraine. Cites a CVE in CISA KEV.
  • Tue 3 Feb, 12:45 UTC. Security Affairs. APT28 exploits Microsoft Office flaw in Operation Neusploit. Cites a CVE in CISA KEV.
  • Mon 9 Feb, 00:40 UTC. SecurityOnline. APT28 Weaponizes Office Flaw to Spy on NATO & Military. Cites a CVE in CISA KEV.
  • Mon 23 Feb, 21:31 UTC. The Hacker News. Russia linked APT28 uses MacroMaze document beacons to breach PCs.
  • Tue 24 Feb, 09:35 UTC. Security Affairs. Russia's APT28 runs MacroMaze webhook macros to steal data.
  • Mon 2 Mar, 11:39 UTC. The Hacker News. MSHTML CVE-2026-21513 exploited by APT28; patch issued. Cites a CVE in CISA KEV.
  • Mon 2 Mar, 15:44 UTC. Security Affairs. APT28 exploits MSHTML CVE-2026-21513 to run code via LNK. Cites a CVE in CISA KEV.
  • Thu 5 Mar, 11:27 UTC. The Hacker News. APT28 targets Ukraine with BadPaw and MeowMeow via phishing HTA.
  • Thu 5 Mar, 15:35 UTC. Security Affairs. Phishing delivers BadPaw loader and MeowMeow backdoor; APT28 link.
  • Tue 10 Mar, 12:22 UTC. The Hacker News. APT28 Deploys BEARDSHELL and COVENANT to spy on Ukrainian military.
  • Tue 10 Mar, 15:58 UTC. Security Affairs. APT28 conducts long-term espionage on Ukrainian forces using custom malware.
  • Tue 10 Mar, 20:31 UTC. Dark Reading. Russian Threat Actor Sednit Resurfaces With Sophisticated Toolkit.
  • Thu 19 Mar, 15:35 UTC. DataBreaches, its first report on the story. Russian hackers exploit Zimbra flaw in Ukrainian govt attacks. Cites a CVE in CISA KEV.
  • Thu 26 Mar, 03:45 UTC. trendmicro.com, its first report on the story. Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure Entities. Cites a CVE in CISA KEV.
  • Tue 7 Apr, 13:30 UTC. NCSC, its first report on the story. APT28 exploits routers to redirect DNS, stealing credentials.
  • Tue 7 Apr, 13:31 UTC. NCSC. NCSC Warns Russian APT28 Hijacks Routers for DNS Attacks.
  • Tue 7 Apr, 15:27 UTC. Microsoft, its first report on the story. Forest Blizzard hijacks routers to spy via AI enabled DNS attacks.
  • Tue 7 Apr, 16:01 UTC. Infosecurity, its first report on the story. APT28 exploits SOHO routers via CVE‑2023‑50224 to steal credentials. Cites a CVE in CISA KEV.
  • Tue 7 Apr, 18:11 UTC. The Hacker News. APT28 hijacks routers worldwide in DNS based FrostArmada campaign. Cites a CVE in CISA KEV.
  • Wed 8 Apr, 10:30 UTC. Infosecurity. US and FBI shut down Russian hackers' router hijacking network.
  • Wed 8 Apr, 11:00 UTC. SecurityWeek. US Disrupts Russian Espionage Operation Involving Hacked Routers and DNS Hijacking.
  • Wed 8 Apr, 11:31 UTC. Ars Technica, its first report on the story. Russian APT28 hijacks home routers to steal credentials.
  • Wed 8 Apr, 12:41 UTC. DataBreaches. APT28 hijacks routers worldwide to steal passwords via DNS attack.
  • Wed 8 Apr, 13:51 UTC. Malwarebytes, its first report on the story. UK warns Russian hackers hijack home routers for spying.
  • Wed 8 Apr, 16:11 UTC. The Hacker News. APT28 Deploys New PRISMEX Malware Against Ukraine and NATO Allies. Cites a CVE in CISA KEV.
  • Wed 8 Apr, 21:11 UTC. Security Affairs. Russia-linked APT28 uses PRISMEX to infiltrate Ukraine and allied infrastructure with advanced tactics. Cites a CVE in CISA KEV.
  • Thu 9 Apr, 01:31 UTC. Dark Reading. APT28's Year Long Router Hijacking Campaign Exposes World Traffic.
  • Thu 9 Apr, 21:31 UTC. Dark Reading. Trend Micro Exposes Fancy Bears Prismex Malware Targeting Ukraine. Cites a CVE in CISA KEV.
  • Mon 27 Apr, 13:41 UTC. SecurityWeek. APT28 exploits Windows SmartScreen gap for zero click LNK attacks. Cites a CVE in CISA KEV.
  • Tue 28 Apr, 07:21 UTC. The Hacker News. Microsoft Warns of Active Exploit in CVE-2026-32202 Spoof Flaw. Cites a CVE in CISA KEV.
  • Wed 29 Apr, 09:11 UTC. The Hacker News. CISA Flags Actively Exploited CVE-2024-1708 and Windows Flaw. Cites a CVE in CISA KEV.
  • Mon 4 May, 15:31 UTC. SOCRadar. AI Powered Scams Rise as Deepfake Calls Cost Firms Millions.
  • Tue 5 May, 02:31 UTC. Infosecurity. US defence contractors warned of nation state edge device attacks.
  • Fri 8 May, 19:31 UTC. Security Affairs. Polish water plants breached by Russian APT via weak passwords.
  • Mon 8 Jun, 08:59 UTC. SecurityOnline. APT28’s PixyNetLoader uses PNG steganography to hide malware.
  • Tue 16 Jun, 21:31 UTC. dti.domaintools.com, its first report on the story. GRU hackers use compromised routers to spy on UK officials. This article, 54th of 61.
  • Sun 26 Jul, 14:08 UTC. Security Affairs. Hotel WiFi attacks hijack Microsoft 365 logins, linked to APT28.
  • Thu 27 Aug, 20:46 UTC. dti.domaintools.com. Leak shows Moscow university training cyber troops for Russia.
  • Fri 28 Aug, 09:06 UTC. The Hacker News. APT28 Uses HOOKEDGE Backdoor to Spy on European Govt Networks.
  • Fri 28 Aug, 12:29 UTC. Security Affairs. BlueDelta APT deploys HOOKEDGE backdoor via malicious Word macros.
  • Wed 2 Sep, 08:28 UTC. SecurityOnline. HOOKEDGE Malware: BlueDelta Hits EU Diplomatic Targets. Cites a CVE in CISA KEV.
  • Tue 20 Oct, 12:31 UTC. The Hacker News. APT28 Breaches NATO Naval Shipbuilder and Steals Credentials in Week-Long Intrusion. Cites a CVE in CISA KEV.
  • Thu 22 Oct, 09:22 UTC. SecurityOnline. Fancy Bear Used Webhook.site to Breach European Defence Targets.
  • Known exploited CVE
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
Show all 61 articles as a list
  1. Wed 3 SepDay 01
    1. Russia's APT28 Targets Microsoft Outlook With 'NotDoor' Malware22:09 · Dark Reading · First report
  2. Thu 4 SepDay 11
    1. Russian APT28 Deploys “NotDoor” Outlook Backdoor Against Companies in NATO Countries18:30 · The Hacker News
  3. Fri 5 SepDay 21
    1. NotDoor: A New Backdoor by Russia’s APT28 Is Hiding in Microsoft Outlook Macros01:00 · SecurityOnline

  4. Quiet for 5 days

    Wed 10 SepDay 71
    1. GONEPOSTAL: New Outlook Backdoor by Russia’s APT28 Uses Email for C201:46 · SecurityOnline · Picked up again

  5. Quiet for 6 days

    Tue 16 SepDay 131
    1. APT28 Exploits Signal Messenger to Deploy eardShell and Covenant Malware13:08 · GBHackers · Picked up again
  6. Wed 17 SepDay 141
    1. APT28’s BeardShell Campaign: Steganography, Cloud Abuse, and Persistent Espionage02:25 · SecurityOnline

  7. Quiet for 4 weeks

    Fri 17 OctDay 441
    1. APT28 Deploys BeardShell and Covenant Modules via Weaponized Office Documents09:00 · GBHackers · Picked up again

  8. Quiet for 3 weeks

    Thu 6 NovDay 641
    1. Next-Gen Threat: Google Exposes AI-Enabled Malware That Rewrites Its Own Code with Gemini LLM03:15 · SecurityOnline · Picked up again

  9. Quiet for 6 weeks

    Wed 17 DecDay 1051
    1. APT28 Targets Ukrainian UKR-net Users in Long-Running Credential Phishing Campaign15:50 · The Hacker News · Picked up again

  10. Quiet for 4 days

    Mon 22 DecDay 1101
    1. The GRU’s Silent Shift: How BlueDelta Hijacks Ukrainian Webmail Using ngrok and Mocky00:41 · SecurityOnline · Picked up again

  11. Quiet for 3 weeks

    Fri 9 JanDay 1282
    1. BlueDelta Espionage: Russian Hackers Abuse Free Apps to Target Energy Sector01:40 · SecurityOnline · Picked up again
    2. Russian APT28 Runs Credential-Stealing Campaign Targeting Energy and Policy Organizations16:36 · The Hacker News

  12. Quiet for 3 days

    Mon 12 JanDay 1312
    1. Credential-harvesting attacks by APT28 hit Turkish, European, and Central Asian organizations10:30 · Security Affairs · Picked up again
    2. Russia’s APT28 Targeting Energy Research, Defense Collaboration Entities12:50 · SecurityWeek

  13. Quiet for 8 days

    Tue 20 JanDay 1391
    1. Dark Web Profile: APT2813:16 · SOCRadar · Picked up again

  14. Quiet for 2 weeks

    Tue 3 FebDay 1535
    1. Fancy Bear Returns: APT28 Exploits Office Flaw in “Operation Neusploit”03:15 · SecurityOnline · Exploited CVE · Picked up again · Known exploited CVE
    2. APT28 Uses Microsoft Office CVE-2026-21509 in Espionage-Focused Malware Attacks10:00 · The Hacker News · Known exploited CVE
    3. Russia’s APT28 Rapidly Weaponizes Newly Patched Office Vulnerability11:40 · SecurityWeek · Known exploited CVE
    Show 2 more from 3 Feb
    1. CVE-2026-21509: APT28 Actively Exploits Microsoft Office Vulnerability in Ukraine11:40 · SOCRadar · Known exploited CVE
    2. APT28 exploits Microsoft Office flaw in Operation Neusploit12:45 · Security Affairs · Known exploited CVE

  15. Quiet for 5 days

    Mon 9 FebDay 1591
    1. APT28 Weaponizes Office Flaw to Spy on NATO & Military00:40 · SecurityOnline · Picked up again · Known exploited CVE

  16. Quiet for 2 weeks

    Mon 23 FebDay 1731
    1. Russia linked APT28 uses MacroMaze document beacons to breach PCs21:31 · The Hacker News · Picked up again
  17. Tue 24 FebDay 1741
    1. Russia's APT28 runs MacroMaze webhook macros to steal data09:35 · Security Affairs

  18. Quiet for 6 days

    Mon 2 MarDay 1802
    1. MSHTML CVE-2026-21513 exploited by APT28; patch issued11:39 · The Hacker News · Picked up again · Known exploited CVE
    2. APT28 exploits MSHTML CVE-2026-21513 to run code via LNK15:44 · Security Affairs · Known exploited CVE

  19. Quiet for 3 days

    Thu 5 MarDay 1832
    1. APT28 targets Ukraine with BadPaw and MeowMeow via phishing HTA11:27 · The Hacker News · Picked up again
    2. Phishing delivers BadPaw loader and MeowMeow backdoor; APT28 link15:35 · Security Affairs

  20. Quiet for 5 days

    Tue 10 MarDay 1883
    1. APT28 Deploys BEARDSHELL and COVENANT to spy on Ukrainian military12:22 · The Hacker News · Picked up again
    2. APT28 conducts long-term espionage on Ukrainian forces using custom malware15:58 · Security Affairs
    3. Russian Threat Actor Sednit Resurfaces With Sophisticated Toolkit20:31 · Dark Reading

  21. Quiet for 9 days

    Thu 19 MarDay 1971
    1. Russian hackers exploit Zimbra flaw in Ukrainian govt attacks15:35 · DataBreaches · Picked up again · Known exploited CVE

  22. Quiet for 7 days

    Thu 26 MarDay 2041
    1. Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure Entities03:45 · trendmicro.com · Picked up again · Known exploited CVE

  23. Quiet for 12 days

    Tue 7 AprDay 2165
    1. APT28 exploits routers to redirect DNS, stealing credentials13:30 · NCSC · official · NCSC alert · Picked up again
    2. NCSC Warns Russian APT28 Hijacks Routers for DNS Attacks13:31 · NCSC · official
    3. Forest Blizzard hijacks routers to spy via AI enabled DNS attacks15:27 · Microsoft
    Show 2 more from 7 Apr
    1. APT28 exploits SOHO routers via CVE‑2023‑50224 to steal credentials16:01 · Infosecurity · Known exploited CVE
    2. APT28 hijacks routers worldwide in DNS based FrostArmada campaign18:11 · The Hacker News · Known exploited CVE
  24. Wed 8 AprDay 2177
    1. US and FBI shut down Russian hackers' router hijacking network10:30 · Infosecurity
    2. US Disrupts Russian Espionage Operation Involving Hacked Routers and DNS Hijacking11:00 · SecurityWeek
    3. Russian APT28 hijacks home routers to steal credentials11:31 · Ars Technica
    Show 4 more from 8 Apr
    1. APT28 hijacks routers worldwide to steal passwords via DNS attack12:41 · DataBreaches
    2. UK warns Russian hackers hijack home routers for spying13:51 · Malwarebytes
    3. APT28 Deploys New PRISMEX Malware Against Ukraine and NATO Allies16:11 · The Hacker News · Known exploited CVE
    4. Russia-linked APT28 uses PRISMEX to infiltrate Ukraine and allied infrastructure with advanced tactics21:11 · Security Affairs · Known exploited CVE
  25. Thu 9 AprDay 2182
    1. APT28's Year Long Router Hijacking Campaign Exposes World Traffic01:31 · Dark Reading
    2. Trend Micro Exposes Fancy Bears Prismex Malware Targeting Ukraine21:31 · Dark Reading · Known exploited CVE

  26. Quiet for 3 weeks

    Mon 27 AprDay 2361
    1. APT28 exploits Windows SmartScreen gap for zero click LNK attacks13:41 · SecurityWeek · Picked up again · Known exploited CVE
  27. Tue 28 AprDay 2371
    1. Microsoft Warns of Active Exploit in CVE-2026-32202 Spoof Flaw07:21 · The Hacker News · Known exploited CVE
  28. Wed 29 AprDay 2381
    1. CISA Flags Actively Exploited CVE-2024-1708 and Windows Flaw09:11 · The Hacker News · Known exploited CVE

  29. Quiet for 5 days

    Mon 4 MayDay 2431
    1. AI Powered Scams Rise as Deepfake Calls Cost Firms Millions15:31 · SOCRadar · Picked up again
  30. Tue 5 MayDay 2441
    1. US defence contractors warned of nation state edge device attacks02:31 · Infosecurity

  31. Quiet for 4 days

    Fri 8 MayDay 2471
    1. Polish water plants breached by Russian APT via weak passwords19:31 · Security Affairs · Picked up again

  32. Quiet for 4 weeks

    Mon 8 JunDay 2781
    1. APT28’s PixyNetLoader uses PNG steganography to hide malware08:59 · SecurityOnline · Picked up again

  33. Quiet for 9 days

    Tue 16 JunDay 2861
    1. GRU hackers use compromised routers to spy on UK officials21:31 · dti.domaintools.com · Picked up again · This article, 54th of 61

  34. Quiet for 6 weeks

    Sun 26 JulDay 3261
    1. Hotel WiFi attacks hijack Microsoft 365 logins, linked to APT2814:08 · Security Affairs · Picked up again

  35. Quiet for 5 weeks

    Thu 27 AugDay 3581
    1. Leak shows Moscow university training cyber troops for Russia20:46 · dti.domaintools.com · Picked up again
  36. Fri 28 AugDay 3592
    1. APT28 Uses HOOKEDGE Backdoor to Spy on European Govt Networks09:06 · The Hacker News
    2. BlueDelta APT deploys HOOKEDGE backdoor via malicious Word macros12:29 · Security Affairs

  37. Quiet for 5 days

    Wed 2 SepDay 3641
    1. HOOKEDGE Malware: BlueDelta Hits EU Diplomatic Targets08:28 · SecurityOnline · Picked up again · Known exploited CVE

  38. Quiet for 7 weeks

    Tue 20 OctDay 4121
    1. APT28 Breaches NATO Naval Shipbuilder and Steals Credentials in Week-Long Intrusion12:31 · The Hacker News · Picked up again · Known exploited CVE

  39. Quiet for 2 days

    Thu 22 OctDay 4141
    1. Fancy Bear Used Webhook.site to Breach European Defence Targets09:22 · SecurityOnline

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in