Russia's Fancy Bear still attacking routers to boost fake sites, NCSC warns

UK's NCSC warns that Russian APT28 (Fancy Bear) continues exploiting SOHO router vulnerabilities to hijack DNS and harvest credentials through phishing. The group targets TP-Link, Cisco, and MikroTik devices, redirecting victims to counterfeit service pages. Activity has been tracked since 2021, with Ukraine-located routers believed to be priority targets for military intelligence gathering.