APT28 Exploits SOHO Routers to Hijack DNS and Steal Credentials
Summary
NCSC details how APT28 exploited SOHO routers, including TP-Link devices, to redirect DNS queries and conduct adversary-in-the-middle attacks aimed at stealing passwords and authentication tokens.
Key points
- APT28 altered compromised routers’ DHCP DNS settings so downstream devices used actor-controlled DNS servers.
- Targeted domain lookups were redirected to actor-controlled IPs, enabling adversary-in-the-middle attacks against browser sessions and desktop applications.
- The activity aimed to harvest passwords and authentication tokens, including OAuth tokens; follow-on malicious logins could use other infrastructure.
- APT28 likely exploited CVE-2023-50224 on TP-Link WR841N routers to obtain credentials, then sent a second crafted HTTP GET request to change DNS settings.
- The advisory describes a second infrastructure cluster that received forwarded DNS requests and conducted interactive operations against a small number of MikroTik routers, often in Ukraine.
- The NCSC attributes the activity to Russia’s GRU Unit 26165 and provides extensive IP indicators for both infrastructure clusters.
Article Details
- Attack Vectors
- APT28 exploited TP-Link WR841N routers, likely using CVE-2023-50224, to obtain router credentials through specially crafted HTTP GET requests, then sent another crafted request to change DHCP DNS settings.
- Compromised SOHO routers distributed actor-owned DNS server settings to downstream devices. Queries for selected service-related terms were resolved to actor-owned IP addresses, enabling adversary-in-the-middle attempts against browser sessions and desktop applications.
- A second infrastructure cluster received DNS requests forwarded by likely compromised MikroTik and TP-Link routers and relayed them to further actor-owned servers; it also conducted interactive operations against some MikroTik routers.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 103[.]140[.]186[.]148 | Listed as APT28 cluster-two infrastructure involved in DNS hijacking and wider router operations. |
| IPV4 | 103[.]140[.]186[.]149 | Listed as APT28 cluster-two infrastructure involved in DNS hijacking and wider router operations. |
| IPV4 | 103[.]140[.]186[.]155 | Listed as APT28 cluster-two infrastructure involved in DNS hijacking and wider router operations. |
| IPV4 | 185[.]117[.]88[.]22 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]117[.]88[.]28 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]117[.]88[.]29 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]117[.]88[.]30 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]117[.]88[.]31 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]117[.]88[.]50 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]117[.]88[.]60 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]117[.]88[.]61 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]117[.]88[.]62 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]117[.]89[.]32 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]117[.]89[.]46 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]117[.]89[.]47 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]234[.]73[.]58 | Listed as APT28 cluster-two infrastructure involved in DNS hijacking and wider router operations. |
| IPV4 | 185[.]234[.]73[.]61 | Listed as APT28 cluster-two infrastructure involved in DNS hijacking and wider router operations. |
| IPV4 | 185[.]234[.]73[.]62 | Listed as APT28 cluster-two infrastructure involved in DNS hijacking and wider router operations. |
| IPV4 | 185[.]237[.]166[.]224 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]225 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]226 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]227 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]228 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]229 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]230 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]231 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]232 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]233 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]234 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]235 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]236 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]237 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]238 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]239 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]240 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]241 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]242 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]243 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]244 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]245 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]246 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]247 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]248 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]249 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]55 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]56 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]57 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]58 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]59 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]60 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]61 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]62 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]63 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]64 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]65 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]66 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]67 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]68 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]69 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]70 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]71 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]72 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]73 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]74 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 185[.]237[.]166[.]75 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 23[.]106[.]120[.]119 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 37[.]221[.]64[.]101 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 37[.]221[.]64[.]116 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 37[.]221[.]64[.]131 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 37[.]221[.]64[.]148 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 37[.]221[.]64[.]149 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 37[.]221[.]64[.]150 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 37[.]221[.]64[.]151 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 37[.]221[.]64[.]163 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 37[.]221[.]64[.]173 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 37[.]221[.]64[.]199 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 37[.]221[.]64[.]208 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 37[.]221[.]64[.]224 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 37[.]221[.]64[.]254 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 37[.]221[.]64[.]77 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 37[.]221[.]64[.]78 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 37[.]221[.]64[.]93 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 5[.]226[.]137[.]151 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 5[.]226[.]137[.]230 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 5[.]226[.]137[.]231 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 5[.]226[.]137[.]232 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 5[.]226[.]137[.]234 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 5[.]226[.]137[.]235 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 5[.]226[.]137[.]242 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 5[.]226[.]137[.]243 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 5[.]226[.]137[.]244 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 5[.]226[.]137[.]245 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 64[.]120[.]31[.]100 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 64[.]120[.]31[.]96 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 64[.]120[.]31[.]97 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 64[.]120[.]31[.]98 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 64[.]120[.]31[.]99 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 64[.]44[.]154[.]227 | Listed as APT28 cluster-two infrastructure involved in DNS hijacking and wider router operations. |
| IPV4 | 64[.]44[.]154[.]237 | Listed as APT28 cluster-two infrastructure involved in DNS hijacking and wider router operations. |
| IPV4 | 64[.]44[.]154[.]238 | Listed as APT28 cluster-two infrastructure involved in DNS hijacking and wider router operations. |
| IPV4 | 64[.]44[.]154[.]239 | Listed as APT28 cluster-two infrastructure involved in DNS hijacking and wider router operations. |
| IPV4 | 64[.]44[.]154[.]240 | Listed as APT28 cluster-two infrastructure involved in DNS hijacking and wider router operations. |
| IPV4 | 77[.]83[.]197[.]37 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 77[.]83[.]197[.]38 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 77[.]83[.]197[.]39 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 77[.]83[.]197[.]40 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 77[.]83[.]197[.]41 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 77[.]83[.]197[.]42 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 77[.]83[.]197[.]43 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 77[.]83[.]197[.]44 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 77[.]83[.]197[.]45 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 77[.]83[.]197[.]46 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 77[.]83[.]197[.]47 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 77[.]83[.]197[.]48 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 77[.]83[.]197[.]49 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 77[.]83[.]197[.]50 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 77[.]83[.]197[.]51 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 77[.]83[.]197[.]52 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 77[.]83[.]197[.]53 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 77[.]83[.]197[.]54 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 77[.]83[.]197[.]55 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 77[.]83[.]197[.]56 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 77[.]83[.]197[.]57 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 77[.]83[.]197[.]58 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 77[.]83[.]197[.]59 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 77[.]83[.]197[.]60 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 77[.]83[.]198[.]39 | Listed as APT28 cluster-two infrastructure involved in DNS hijacking and wider router operations. |
| IPV4 | 79[.]141[.]160[.]78 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 79[.]141[.]161[.]66 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 79[.]141[.]161[.]67 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 79[.]141[.]161[.]68 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 79[.]141[.]161[.]69 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 79[.]141[.]161[.]70 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 79[.]141[.]161[.]71 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 79[.]141[.]161[.]72 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 79[.]141[.]161[.]73 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 79[.]141[.]161[.]74 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 79[.]141[.]161[.]75 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 79[.]141[.]161[.]76 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 79[.]141[.]161[.]77 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 79[.]141[.]161[.]78 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 79[.]141[.]161[.]79 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 79[.]141[.]161[.]80 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 79[.]141[.]161[.]81 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 79[.]141[.]161[.]82 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 79[.]141[.]161[.]83 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 79[.]141[.]161[.]84 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 79[.]141[.]161[.]85 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 79[.]141[.]173[.]103 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 79[.]141[.]173[.]119 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 79[.]141[.]173[.]120 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 79[.]141[.]173[.]121 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 79[.]141[.]173[.]122 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 79[.]141[.]173[.]123 | Listed as APT28 cluster-two infrastructure involved in DNS hijacking and wider router operations. |
| IPV4 | 79[.]141[.]173[.]200 | Listed as APT28 cluster-two infrastructure involved in DNS hijacking and wider router operations. |
| IPV4 | 79[.]141[.]173[.]210 | Listed as APT28 cluster-two infrastructure involved in DNS hijacking and wider router operations. |
| IPV4 | 79[.]141[.]173[.]211 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 79[.]141[.]173[.]231 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 79[.]141[.]173[.]232 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 79[.]141[.]173[.]233 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 79[.]141[.]173[.]246 | Listed as APT28 cluster-two infrastructure involved in DNS hijacking and wider router operations. |
| IPV4 | 79[.]141[.]173[.]247 | Listed as APT28 cluster-two infrastructure involved in DNS hijacking and wider router operations. |
| IPV4 | 79[.]141[.]173[.]248 | Listed as APT28 cluster-two infrastructure involved in DNS hijacking and wider router operations. |
| IPV4 | 79[.]141[.]173[.]249 | Listed as APT28 cluster-two infrastructure involved in DNS hijacking and wider router operations. |
| IPV4 | 79[.]141[.]173[.]250 | Listed as APT28 cluster-two infrastructure involved in DNS hijacking and wider router operations. |
| IPV4 | 79[.]141[.]173[.]251 | Listed as APT28 cluster-two infrastructure involved in DNS hijacking and wider router operations. |
| IPV4 | 79[.]141[.]173[.]252 | Listed as APT28 cluster-two infrastructure involved in DNS hijacking and wider router operations. |
| IPV4 | 79[.]141[.]173[.]253 | Listed as APT28 cluster-two infrastructure involved in DNS hijacking and wider router operations. |
| IPV4 | 79[.]141[.]173[.]254 | Listed as APT28 cluster-two infrastructure involved in DNS hijacking and wider router operations. |
| IPV4 | 79[.]141[.]173[.]70 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 79[.]141[.]173[.]96 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 79[.]141[.]173[.]97 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 79[.]141[.]173[.]98 | Listed as malicious APT28 DNS-server and adversary-in-the-middle infrastructure in cluster one. |
| IPV4 | 79[.]143[.]87[.]229 | Listed as APT28 cluster-two infrastructure involved in DNS hijacking and wider router operations. |
| IPV4 | 79[.]143[.]87[.]232 | Listed as APT28 cluster-two infrastructure involved in DNS hijacking and wider router operations. |
| IPV4 | 79[.]143[.]87[.]240 | Listed as APT28 cluster-two infrastructure involved in DNS hijacking and wider router operations. |
| IPV4 | 79[.]143[.]87[.]243 | Listed as APT28 cluster-two infrastructure involved in DNS hijacking and wider router operations. |
| IPV4 | 79[.]143[.]87[.]249 | Listed as APT28 cluster-two infrastructure involved in DNS hijacking and wider router operations. |
| IPV4 | 88[.]80[.]148[.]49 | Listed as APT28 cluster-two infrastructure involved in DNS hijacking and wider router operations. |
| IPV4 | 88[.]80[.]148[.]53 | Listed as APT28 cluster-two infrastructure involved in DNS hijacking and wider router operations. |
| IPV4 | 89[.]150[.]40[.]43 | Listed as APT28 cluster-two infrastructure involved in DNS hijacking and wider router operations. |
| IPV4 | 89[.]150[.]40[.]86 | Listed as APT28 cluster-two infrastructure involved in DNS hijacking and wider router operations. |
MITRE ATT&CK
T1557 · Adversary-in-the-MiddleThe article explicitly maps this ID to APT28's adversary-in-the-middle activity against follow-on connections after DNS redirection.T1584.008 · Network DevicesThe article explicitly maps this sub-technique to APT28's use of exploited routers in its DNS-poisoning operations.T1586 · Compromise AccountsThe article explicitly maps this ID to the described APT28 activity; it says the actor sought to harvest user credentials and authentication tokens.T1588.006 · VulnerabilitiesThe article explicitly maps this sub-technique to APT28's use of exploited routers in its DNS-poisoning operations.
CVE
Threat Actors
APT28The article attributes router exploitation, DNS hijacking, and adversary-in-the-middle operations to APT28.Fancy BearIdentified by the article as another name for APT28.Forest BlizzardIdentified by the article as another name for APT28.SofacyIdentified by the article as another name for APT28.STRONTIUMIdentified by the article as another name for APT28.the Sednit GangIdentified by the article as another name for APT28.