cyber.hendryadrian.com
Security News · thecyberexpress.com

Weekly Roundup: APT28 DNS Hijacking, $285M Drift Theft, and Security Policy Developments

· Original article ↗

Summary

This roundup covers APT28 router-based DNS hijacking, the reported $285 million Drift Protocol theft, EU uncertainty over voluntary CSAM scanning, recoverable Signal notification data on iPhones, and a new U.S. Treasury digital-asset cybersecurity initiative.

Key points

  • The article says APT28 exploited vulnerable routers for DNS hijacking and adversary-in-the-middle attacks targeting credentials, including those for Microsoft Outlook.
  • The roundup reports attackers stole $285 million from Solana-based Drift Protocol on April 1, 2026, and says the exchange reportedly lost over half its total value in 12 minutes.
  • The expiration of the EU's temporary CSAM framework on April 3, 2026, left uncertainty about voluntary platform scanning and reporting, including hash-matching.
  • An FBI investigation found deleted Signal messages may remain partially recoverable on iPhones through iOS notification storage; the article says this is not a failure of Signal encryption.
  • The U.S. Treasury launched a Digital Asset Cybersecurity Initiative through OCCIP to strengthen defenses across the cryptocurrency ecosystem.

Article Details

Event Type
Weekly roundup covering DNS hijacking, a cryptocurrency theft, regulatory uncertainty, mobile data persistence, and a government cybersecurity initiative.
Impact
APT28’s DNS hijacking and adversary-in-the-middle attacks intercepted traffic and targeted credentials. Attackers stole $285 million from Drift Protocol, which reportedly lost over half its total value within 12 minutes. The roundup also reports legal uncertainty over voluntary CSAM scanning and partial recoverability of deleted Signal messages from iPhones due to iOS notification storage.

MITRE ATT&CK

T1557 · Adversary-in-the-MiddleAPT28 reportedly used adversary-in-the-middle attacks to intercept traffic and credentials.

Threat Actors

APT28The article describes APT28 as a Russian-linked threat group that exploited vulnerable routers for DNS hijacking and adversary-in-the-middle attacks targeting traffic and credentials.

Vendors

MicrosoftAPT28 exploited vulnerable routers for DNS hijacking and AITM attacks to intercept credentials from targets like Microsoft Outlook.

Products

Drift ProtocolThis week’s roundup covers state-sponsored DNS hijacking campaigns, a $285 million exploit of Drift Protocol on Solana, regulatory uncertainty around EU CSAM detection, and findings that deleted Signal data can persistiOSAn FBI finding showed deleted Signal messages can remain partially recoverable on iPhones due to iOS notification storage, not Signal encryption failure.iPhoneFBI Finds Deleted Signal Data Can Persist in iPhone Systems Microsoft OutlookAPT28 exploited vulnerable routers for DNS hijacking and AITM attacks to intercept credentials from targets like Microsoft Outlook.Signalof Drift Protocol on Solana, regulatory uncertainty around EU CSAM detection, and findings that deleted Signal data can persist on iPhones.Solanaroundup covers state-sponsored DNS hijacking campaigns, a $285 million exploit of Drift Protocol on Solana, regulatory uncertainty around EU CSAM detection, and findings that deleted Signal data can persist on

Countries

United StatesIt also highlights the U.S. Treasury’s new Digital Asset Cybersecurity Initiative and a pattern of attackers combining infrastructure compromise, social engineering, and long-term strategic targeting.

Industries

CryptocurrencyTreasury launched a Digital Asset Cybersecurity Initiative through OCCIP to strengthen defenses across the cryptocurrency ecosystem.TechnologyThe expiration of the EU’s temporary 2021 regulatory framework on April 3, 2026, has created uncertainty around how technology companies can detect and report Child Sexual Abuse Material (CSAM).

Related Articles