APT28 exploit routers to enable DNS hijacking operations

The UK NCSC reports that APT28 has been exploiting vulnerabilities in SOHO routers (notably TP-Link models via CVE-2023-50224 and some MikroTik devices) to overwrite DHCP/DNS settings so downstream devices use attacker-controlled DNS servers; this DNS hijacking funnels targeted Outlook and email-related requests to malicious infrastructure enabling adversary-in-the-middle operations to harvest passwords and OAuth tokens. The advisory provides cluster-based VPS/banner indicators, large lists of associated IP addresses, targeted domains, affected router models, MITRE ATT&CK mappings, and defensive mitigations.