Threat actor

APT28

Tracked by CyberSIXT since Apr 7, 2026 · last activity Jun 16, 2026

Linked incidents

CISA adds Windows Shell and ConnectWise ScreenConnect flaws to Known Exploited Vulnerabilities catalog

Associated CVEs

CVE-2024-1709KEV CVE-2025-32711 CVE-2026-21510KEV CVE-2026-21513KEV CVE-2024-1708KEV CVE-2026-21509KEV CVE-2023-50224KEV CVE-2026-32202KEV

Coverage timeline

GRU hackers use compromised routers to spy on UK officials
dti.domaintools.com · Jun 16, 2026
APT28’s PixyNetLoader uses PNG steganography to hide malware
securityonline.info · Jun 8, 2026
Polish water plants breached by Russian APT via weak passwords
securityaffairs.com · May 8, 2026
AI Powered Scams Rise as Deepfake Calls Cost Firms Millions
socradar.io · May 4, 2026
CISA Flags Actively Exploited CVE-2024-1708 and Windows Flaw
thehackernews.com · Apr 29, 2026
Microsoft Warns of Active Exploit in CVE-2026-32202 Spoof Flaw
thehackernews.com · Apr 28, 2026
APT28 exploits Windows SmartScreen gap for zero click LNK attacks
www.securityweek.com · Apr 27, 2026
RegPhantom Rootkit Lets Attackers Gain Kernel Access on Windows
thehackernews.com · Apr 13, 2026
Malicious npm Strapi Packages Spread Redis RCE and Steal Data
securityaffairs.com · Apr 12, 2026
Trend Micro Exposes Fancy Bears Prismex Malware Targeting Ukraine
www.darkreading.com · Apr 9, 2026
APT28's Year Long Router Hijacking Campaign Exposes World Traffic
www.darkreading.com · Apr 9, 2026
Russia-linked APT28 uses PRISMEX to infiltrate Ukraine and allied infrastructure with advanced tactics
securityaffairs.com · Apr 8, 2026
APT28 Deploys New PRISMEX Malware Against Ukraine and NATO Allies
thehackernews.com · Apr 8, 2026
UK warns Russian hackers hijack home routers for spying
www.malwarebytes.com · Apr 8, 2026
APT28 hijacks routers worldwide to steal passwords via DNS attack
databreaches.net · Apr 8, 2026
Russian APT28 hijacks home routers to steal credentials
arstechnica.com · Apr 8, 2026
US Disrupts Russian Espionage Operation Involving Hacked Routers and DNS Hijacking
www.securityweek.com · Apr 8, 2026
US and FBI shut down Russian hackers' router hijacking network
www.infosecurity-magazine.com · Apr 8, 2026
APT28 hijacks routers worldwide in DNS based FrostArmada campaign
thehackernews.com · Apr 7, 2026
APT28 exploits SOHO routers via CVE‑2023‑50224 to steal credentials
www.infosecurity-magazine.com · Apr 7, 2026
Forest Blizzard hijacks routers to spy via AI enabled DNS attacks
www.microsoft.com · Apr 7, 2026
NCSC Warns Russian APT28 Hijacks Routers for DNS Attacks
www.ncsc.gov.uk · Apr 7, 2026
APT28 exploits routers to redirect DNS, stealing credentials
www.ncsc.gov.uk · Apr 7, 2026