ThreatVectr
Tag

#APT28

5 stories taggedAPT28.

A command-line terminal window displaying batch script code with Cyrillic character hints and European government email domains visible in logs, set against a d
Threat Intelligence

HOOKEDGE: A New Backdoor Aimed at European Government Networks, With Fingerprints Pointing to Russia

Recorded Future says a lightweight Windows batch script is being used against foreign ministries and government offices in Romania, Spain and Türkiye, with tentative links to the group tracked as APT28.

3 min read
A hotel lobby Wi-Fi router mounted on a wall with digital visualization showing intercepted login credentials and passwords flowing from employee devices into a
Threat Intelligence

Hotel and Conference Wi-Fi Networks Hijacked to Steal Corporate Login Details

Criminals are quietly rewriting the internet directions on public Wi-Fi routers at hotels and conference centres, then catching employees' Microsoft 365 passwords mid-air. Researchers say the campaign has been running since at least June 2026.

3 min read
Hotel lobby with business travelers at the front desk and in seating areas, Wi-Fi network selection screen on a laptop showing spoofed networks, fake Microsoft
Threat Intelligence

Hotel Wi-Fi hijack campaign quietly harvests Microsoft 365 logins from business travellers

A cluster with overlapping infrastructure tied to Russia-linked APT28 activity is tampering with DNS on hotel and conference Wi-Fi gateways to funnel guests into fake Microsoft login pages, ReliaQuest reports.

4 min read
Illustration: a dimly lit server rack in an industrial control room, focus on a network router with blinking amber LEDs
Threat Intelligence

Russian FSB hackers are quietly hijacking routers at hospitals, power firms and banks, nine countries warn

A joint advisory from the US, UK, Australia and six allies names FSB Centre 16 as the group scanning the internet for routers with weak passwords and old Cisco flaws.

4 min read
Illustration: cybersecurity experts analyzing a network map with highlighted compromised routers
Threat Intelligence

GRU Operators Drained Microsoft 365 Tokens by Rewriting DNS on 18,000 SOHO Routers

Forest Blizzard shifted from targeted router malware to mass DNS hijacking after a UK advisory in August, intercepting OAuth tokens on Outlook on the web.

3 min read
© 2026 Threat Vectr