Germany warns of APT28 router hacks

Germany’s domestic intelligence agency on Tuesday warned that Russian state-linked hacking group APT28 has compromised vulnerable TP-Link internet routers to spy on military, government, and critical infrastructure targets.

The Federal Office for the Protection of the Constitution (BfV) said the alert was issued with partners including the foreign intelligence service BND and the US FBI. APT28—also known as “Fancy Bear” and attributed by Western governments to Russia’s GRU military intelligence—attacked several thousand routers worldwide, including about 30 vulnerable devices in Germany, according to the BfV.

In some cases, compromises were confirmed, prompting operators to replace affected routers. The agency noted APT28’s prior intrusions against Germany’s parliament, the centre-left SPD party, and air traffic control authorities, and urged immediate remediation on exposed or unpatched TP-Link devices.