APT28 Leverages Compromised Routers for Credential Theft (infosecurity-magazine.com)

• Malicious DNS redirection via compromised router hardware
• Credential harvesting enabled by VPS-based infrastructure
• UK security agencies issue formal advisory on APT28 methods

"Russian state-linked threat actor APT28 has launched a sophisticated campaign hijacking routers to redirect traffic through malicious DNS servers hosted on virtual private servers. This infrastructure allows the group to intercept and exfiltrate user credentials. UK intelligence confirms these methods pose a significant threat to digital infrastructure integrity."