APT28 Hijacked Home Routers to Steal Outlook Logins, NCSC Says

Russia’s APT28 has been breaking into home and small-office routers and quietly changing their DNS settings, so that people behind them get routed to the attackers when they log in to Outlook. The UK’s National Cyber Security Centre laid out the operation in an April 7, 2026 alert (also published as a PDF). The NCSC says APT28 is almost certainly GRU Unit 26165 and that the activity has run from 2024 into 2026.

5.226.137[.]151
23.106.120[.]119
37.221.64[.]77
64.120.31[.]96
77.83.197[.]37
79.141.160[.]78
79.141.173[.]70
185.117.88[.]22
185.237.166[.]55
64.44.154[.]227
77.83.198[.]39
79.143.87[.]229
88.80.148[.]49
89.150.40[.]43
103.140.186[.]148
185.234.73[.]58

Source article: APT28 exploit routers to enable DNS hijacking operations
Publisher: National Cyber Security Centre (NCSC, UK)
Published: April 7, 2026
URL: https://www.ncsc.gov.uk/news/apt28-exploit-routers-to-enable-dns-hijacking-operations

Executive Summary

The UK NCSC assesses that APT28 (also known as Forest Blizzard, Fancy Bear, STRONTIUM, the Sednit Gang and Sofacy), almost certainly GRU 85th Main Special Service Centre (GTsSS) Military Intelligence Unit 26165, has since 2024 and into 2026 run DNS hijacking operations built on compromised small office and home office routers. In the first infrastructure cluster, the actor exploited TP-Link routers (the WR841N likely through CVE-2023-50224, which leaks credentials to an unauthenticated HTTP GET request) and used a second crafted GET request to rewrite the router’s DHCP DNS settings, usually setting an actor server as primary and demoting the original primary to secondary. Every laptop and phone behind the router then inherited the actor’s resolver, a dnsmasq-2.85 service on a VPS that answered most queries truthfully but resolved Outlook and login-related names (and some non-Outlook domains) to actor-owned addresses, where the actor attempted adversary-in-the-middle interception of browser and desktop-application sessions to harvest passwords and OAuth tokens. A second cluster relayed DNS from compromised MikroTik and TP-Link routers to further actor servers and was used for hands-on operations against a small number of MikroTik routers, often in Ukraine. The NCSC describes the campaign as opportunistic at first and then filtered down to users of likely intelligence value; the impact is credential and token theft for email and web services, with follow-on logins that may come from infrastructure not in the advisory. The NCSC publishes two VPS banner patterns, 23 targeted TP-Link models, five targeted domains and about 240 actor IP addresses but no detection rules; hunt leads, false positive expectations and indicators are detailed below.

ATT&CK chain: Resource Development → Initial Access → Credential Access

Hunt Lead Grid

NCSC APT28 Resolver and AitM IP Sweep

The NCSC lists the VPS addresses behind both clusters: the first cluster’s malicious DNS servers and AitM servers, and the second cluster’s relays and router-operation hosts. Devices behind a hijacked router send their DNS queries straight to one of these addresses on UDP 53, and when a targeted Outlook name is resolved, the follow-on IMAP, Autodiscover or HTTPS connection goes to another actor address in the same ranges. The detection logic is a retrospective search of firewall, NetFlow, DNS-client and proxy logs (and of VPN client telemetry that records the endpoint’s local resolver) for any connection to the addresses below, with DNS traffic on port 53 and TLS on 443 or IMAP on 993 as the highest-value matches.

Sweep back to the start of 2024, which is when the NCSC says the activity began, or as far as your retention allows; the NCSC itself warns that specific selectors change, so a clean result doesn’t clear you. Corporate networks rarely send DNS directly to the internet, so the best visibility is from remote endpoints: EDR network events and VPN or SASE client logs show what resolver a laptop used at home. Blocking these addresses at the corporate edge does little for a laptop on a hijacked home network; push the block list to endpoint firewalls or the secure web gateway client instead. A hit on port 53 means the user’s home or branch router is likely compromised; treat any hit on 443 or 993 as possible credential and token theft, revoke the user’s sessions and refresh tokens, and escalate to incident response.

Cluster one (malicious DNS servers and AitM infrastructure)
5.226.137[.]151  5.226.137[.]230  5.226.137[.]231  5.226.137[.]232  5.226.137[.]234
5.226.137[.]235  5.226.137[.]242  5.226.137[.]243  5.226.137[.]244  5.226.137[.]245
23.106.120[.]119
37.221.64[.]77   37.221.64[.]78   37.221.64[.]93   37.221.64[.]101  37.221.64[.]116
37.221.64[.]131  37.221.64[.]148  37.221.64[.]149  37.221.64[.]150  37.221.64[.]151
37.221.64[.]163  37.221.64[.]173  37.221.64[.]199  37.221.64[.]208  37.221.64[.]224
37.221.64[.]254
64.120.31[.]96   64.120.31[.]97   64.120.31[.]98   64.120.31[.]99   64.120.31[.]100
77.83.197[.]37   77.83.197[.]38   77.83.197[.]39   77.83.197[.]40   77.83.197[.]41
77.83.197[.]42   77.83.197[.]43   77.83.197[.]44   77.83.197[.]45   77.83.197[.]46
77.83.197[.]47   77.83.197[.]48   77.83.197[.]49   77.83.197[.]50   77.83.197[.]51
77.83.197[.]52   77.83.197[.]53   77.83.197[.]54   77.83.197[.]55   77.83.197[.]56
77.83.197[.]57   77.83.197[.]58   77.83.197[.]59   77.83.197[.]60
79.141.160[.]78
79.141.161[.]66  79.141.161[.]67  79.141.161[.]68  79.141.161[.]69  79.141.161[.]70
79.141.161[.]71  79.141.161[.]72  79.141.161[.]73  79.141.161[.]74  79.141.161[.]75
79.141.161[.]76  79.141.161[.]77  79.141.161[.]78  79.141.161[.]79  79.141.161[.]80
79.141.161[.]81  79.141.161[.]82  79.141.161[.]83  79.141.161[.]84  79.141.161[.]85
79.141.173[.]70  79.141.173[.]96  79.141.173[.]97  79.141.173[.]98  79.141.173[.]103
79.141.173[.]119 79.141.173[.]120 79.141.173[.]121 79.141.173[.]122 79.141.173[.]211
79.141.173[.]231 79.141.173[.]232 79.141.173[.]233
185.117.88[.]22  185.117.88[.]28  185.117.88[.]29  185.117.88[.]30  185.117.88[.]31
185.117.88[.]50  185.117.88[.]60  185.117.88[.]61  185.117.88[.]62
185.117.89[.]32  185.117.89[.]46  185.117.89[.]47
185.237.166[.]55  185.237.166[.]56  185.237.166[.]57  185.237.166[.]58  185.237.166[.]59
185.237.166[.]60  185.237.166[.]61  185.237.166[.]62  185.237.166[.]63  185.237.166[.]64
185.237.166[.]65  185.237.166[.]66  185.237.166[.]67  185.237.166[.]68  185.237.166[.]69
185.237.166[.]70  185.237.166[.]71  185.237.166[.]72  185.237.166[.]73  185.237.166[.]74
185.237.166[.]75
185.237.166[.]224 185.237.166[.]225 185.237.166[.]226 185.237.166[.]227 185.237.166[.]228
185.237.166[.]229 185.237.166[.]230 185.237.166[.]231 185.237.166[.]232 185.237.166[.]233
185.237.166[.]234 185.237.166[.]235 185.237.166[.]236 185.237.166[.]237 185.237.166[.]238
185.237.166[.]239 185.237.166[.]240 185.237.166[.]241 185.237.166[.]242 185.237.166[.]243
185.237.166[.]244 185.237.166[.]245 185.237.166[.]246 185.237.166[.]247 185.237.166[.]248
185.237.166[.]249

Cluster two (DNS relays and wider router operations)
64.44.154[.]227  64.44.154[.]237  64.44.154[.]238  64.44.154[.]239  64.44.154[.]240
77.83.198[.]39
79.141.173[.]123 79.141.173[.]200 79.141.173[.]210
79.141.173[.]246 79.141.173[.]247 79.141.173[.]248 79.141.173[.]249 79.141.173[.]250
79.141.173[.]251 79.141.173[.]252 79.141.173[.]253 79.141.173[.]254
79.143.87[.]229  79.143.87[.]232  79.143.87[.]240  79.143.87[.]243  79.143.87[.]249
88.80.148[.]49   88.80.148[.]53
89.150.40[.]43   89.150.40[.]86
103.140.186[.]148 103.140.186[.]149 103.140.186[.]155
185.234.73[.]58  185.234.73[.]61  185.234.73[.]62

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Resource Development → T1583.002 (Acquire Infrastructure: DNS Server); Credential Access → T1557 (Adversary-in-the-Middle) (mapping per source article)

Sources: “APT28 exploit routers to enable DNS hijacking operations”, NCSC, April 7, 2026, https://www.ncsc.gov.uk/news/apt28-exploit-routers-to-enable-dns-hijacking-operations (source article; PDF copy at https://www.ncsc.gov.uk/sites/default/files/2026-05/APT28-exploit-routers-to-enable-DNS-hijacking-operations.pdf)

Outlook Names Resolving Outside Microsoft

The actor’s resolvers answered honestly for everything except their targets, which the NCSC lists as autodiscover-s.outlook[.]com, imap-mail.outlook[.]com, outlook.live[.]com, outlook.office[.]com and outlook.office365[.]com, plus some unnamed non-Outlook domains. Those names were resolved to actor addresses so that the client’s next connection, from a browser or a desktop mail client, landed on AitM infrastructure. That gives a selector-independent detection: the logic is to alert on any DNS answer for those five names (and, more broadly, any Microsoft 365 sign-in or mail hostname) whose returned address falls outside Microsoft’s published Microsoft 365 and Azure ranges, and on any TLS session to those hostnames whose server certificate isn’t issued to Microsoft by a public CA your clients normally see.

Use DNS answer logging where you control the resolver (Windows DNS analytic logs, resolver query logs or protective DNS), EDR DNS telemetry on endpoints (Sysmon Event ID 22 records the answer), and TLS inspection or certificate telemetry from the secure web gateway. Load Microsoft’s published endpoint list and refresh it automatically; a stale list is the main source of false positives. Allowlist known rewriting resolvers such as split-horizon corporate DNS or security proxies by resolver address. Because the NCSC says the actor also redirected non-Outlook domains, extend the same comparison to your identity provider and other critical SaaS login hosts. Any confirmed mismatch from a remote user means the resolver they used is hostile: revoke sessions and tokens, and have the user check the home router. This lead generalizes to any DNS-hijack AitM, whoever runs it.

Hunt Lead Level: 2 (Pro)

ATT&CK: Credential Access → T1557 (Adversary-in-the-Middle) (mapping per source article)

Sources: “APT28 exploit routers to enable DNS hijacking operations”, NCSC, April 7, 2026, https://www.ncsc.gov.uk/news/apt28-exploit-routers-to-enable-dns-hijacking-operations (source article)

VPS Banner Pivot: SSH 56777 or 35681 With dnsmasq-2.85

The NCSC grouped the actor’s servers by two banner patterns: SSH listening on TCP 56777 together with “dnsmasq-2.85” answering on UDP 53 (pattern 1), and SSH on TCP 35681 with the same dnsmasq version (pattern 2, where the DNS service was only present on some hosts). Because the specific IPs will rotate, the banner pair is the durable way to find new actor resolvers. The detection logic is to query internet-scan datasets for hosts exposing SSH on one of those two ports and a dnsmasq-2.85 version string on UDP 53, then test each candidate by resolving the five targeted Outlook names against it and flagging any that return non-Microsoft addresses while answering other names correctly.

Use commercial or community internet-scanning services and passive DNS, then feed confirmed hosts into the block list and the sweep in the first lead. dnsmasq-2.85 alone is widespread (many embedded devices ship it) and nonstandard SSH ports are common, so require both on the same host and give the selective-answer test the final say; never block on the banner alone. Re-run the query weekly, since new VPSs will appear. Probing a candidate resolver from your own infrastructure can tip off the operator, so use an isolated research network. Treat the result as threat intelligence to enrich the other leads rather than an alert on your own network; share confirmed new hosts with your national CERT.

Hunt Lead Level: 2 (Pro)

ATT&CK: Resource Development → T1583.003 (Acquire Infrastructure: Virtual Private Server), T1583.002 (Acquire Infrastructure: DNS Server) (mapping per source article)

Sources: “APT28 exploit routers to enable DNS hijacking operations”, NCSC, April 7, 2026, https://www.ncsc.gov.uk/news/apt28-exploit-routers-to-enable-dns-hijacking-operations (source article)

Remote Endpoint on a Hijacked Resolver, Then a New Sign-In

The compromise happens on the router, not the endpoint: after exploiting a TP-Link model on the NCSC’s list, the actor changes the DHCP-provided DNS servers, typically making its own server the primary and the original resolver the secondary, and sometimes setting both to actor addresses after repeated exploitation. Employees working from home or small branch offices then receive the hostile resolver automatically, and the NCSC notes that logins using the stolen passwords and tokens may come from infrastructure not in the advisory. The detection logic joins two sources per user: endpoint telemetry showing the DHCP-assigned DNS server on a remote laptop changed to an address that isn’t the user’s ISP or a known public resolver (or matches the first lead’s list), and, within the following days, an identity-provider event for that user such as a sign-in from a new IP or ASN, a refresh token or session used from a new location, or a new mail-client registration.

Collect the resolver from EDR or VPN client inventory (ipconfig-style DNS server values per network adapter, captured on connect), and correlate with Entra ID or other identity sign-in and token logs. Home resolvers are noisy, so build a per-user baseline and alert on a change to a VPS-hosted address rather than to another consumer ISP, and raise priority when the old resolver now appears as the secondary, which is the actor’s habit. Forcing all endpoint DNS through an always-on encrypted resolver or corporate DNS removes most of the exposure, and phishing-resistant MFA limits what a stolen password achieves, though stolen tokens still need revocation. On a match, revoke all sessions and refresh tokens, reset credentials from a clean network, and ask the user to factory-reset or replace the router, especially if it’s an unsupported model on the list.

Hunt Lead Level: 3 (Elite)

ATT&CK: Resource Development → T1584.008 (Compromise Infrastructure: Network Devices), T1586 (Compromise Accounts) (mapping per source article)

Sources: “APT28 exploit routers to enable DNS hijacking operations”, NCSC, April 7, 2026, https://www.ncsc.gov.uk/news/apt28-exploit-routers-to-enable-dns-hijacking-operations (source article)

Hash Appendix

The NCSC advisory publishes no file hashes; this campaign runs on router configuration changes and network infrastructure, so there are no samples to list.

References Appendix

• “APT28 exploit routers to enable DNS hijacking operations”, National Cyber Security Centre (UK), April 7, 2026, https://www.ncsc.gov.uk/news/apt28-exploit-routers-to-enable-dns-hijacking-operations (source article; attribution, cluster descriptions, banners, models, targeted domains, IPs, ATT&CK table, mitigations)
• PDF copy of the same advisory, NCSC, https://www.ncsc.gov.uk/sites/default/files/2026-05/APT28-exploit-routers-to-enable-DNS-hijacking-operations.pdf
• MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/