Are You Using These TP-Link Routers? Russian Hackers Are Targeting Them | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #hacker

02yAPvEKkwZG20xTPKUXgQ9-8.fit_lim.size_1200x630.v1775583880.jpg

A Russian state-sponsored hacking group is targeting vulnerable consumer Wi-Fi routers, including 23 TP-Link models that have reached “end of life” status.

The threat involves Fancy Bear, also known as APT 28, a notorious hacking group affiliated with Russian military intelligence. On Tuesday, Microsoft and the UK’s National Cyber Security Centre (NCSC) said the group has been hacking vulnerable routers to manipulate internet traffic and harvest login information.

“Microsoft Threat Intelligence has identified over 200 organizations and 5,000 consumer devices” that have been under attack since at least August, the company warned.

PCMag-Recommended Wi-Fi Routers

$112.99 at
Amazon

$199.99
Save $87.00

See It

$209.99 at
Amazon

$299.99
Save $90.00

See It

Microsoft did not identify the affected device models, but the NCSC published a list and said the Russians are targeting numerous TP-Link products, many of which were originally released over a decade ago. TP-Link lists over half of them as “end of life,” meaning they are no longer on sale and do not receive new software updates, including security patches.

TP-Link TL-WDR3600 N600 Wireless Dual Ban Gigabit Router with end-of-life label

(Credit: TP-Link)

UK NCSC list

(Credit: NCSC)

The NCSC urges the public to “apply security updates promptly” and “use modern systems and software,” suggesting that affected owners should replace outdated hardware. Although TP-Link offers automatic firmware updates, the feature appears to apply only to newer Archer models; everyone else needs to download and install firmware updates manually.

The Russian hackers are likely hijacking routers using publicly known vulnerabilities, including CVE-2023-50224, which was disclosed two years ago. The flaw has been known to affect TP-Link TL-WR841N routers, a product that’s been around for nearly two decades and is still on the market as version v14; the v1 version was discontinued.

UK authorities also detected Russian hackers targeting “a small number of MikroTik routers, often located in Ukraine, that were likely of intelligence value to the actor.”

Recommended by Our Editors

Fancy Bear hijacks routers to overwrite Domain Name System settings, redirecting internet traffic intended for legitimate sites to hacker-controlled DNS servers, which can then ferry users to malicious web pages. Because the malicious web pages look like legitimate services, users can be fooled into entering their passwords and two-factor codes, which the hackers steal.

UK NCSC list of targeted domains

(Credit: NCSC)

“Lookups for domain names containing key terms associated with particular services, often email applications or login pages, would then be resolved by the malicious DNS servers to further actor-owned IP addresses,” the NCSC added. Although the spying can target a large number of users, the goal is to profile “victims of likely intelligence value,” the agency said.

TP-Link didn’t immediately respond to a request for comment. The hacking was disclosed after the US Federal Communications Commission enacted a controversial ban on new foreign-made Wi-Fi router models, citing the threat of supply chain vulnerabilities. All consumer router manufacturers are expected to be affected, as electronics manufacturing largely happens in Asia.