Russian State-Linked APT28 Exploits SOHO Routers in Global DNS Hijacking Campaign
2026-04-08T01:24:13Z•3e307182aa51ea880ab9a331b61a33c6e8afe8d54d82790fa54ceaea4312984f
APT28BYOVD (bring-your-own-vulnerable-driver)China-linkedComfyUIDNS-hijackDPRKDockerFlowiseFortinetIran-linkedMedusaQilinStorm-1175TA416UNC1069Warlockcookie-controlled-webshellcredential-theftcryptominingexposed-instancesnpm-malwareransomwaresocial-engineeringstate-sponsoredsupply-chain
What happened
The Hacker News roundup highlights multiple active, high-impact threats: state-linked actors (APT28, Storm-1175, TA416, DPRK/UNC1069) conducting DNS hijacks, supply-chain and social-engineering compromises, and high-velocity ransomware activity. Several critical and actively exploited vulnerabilities are reported (notably Flowise RCE and an actively exploited FortiClient EMS bug), alongside mass compromise campaigns against exposed services (Flowise, ComfyUI, malicious npm packages) and a major $285M Solana theft. Novel techniques observed include cookie-controlled PHP web shells, BYOVD to tam
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 3e307182aa51ea880ab9a331b61a33c6e8afe8d54d82790fa54ceaea4312984f
- Enrichment time
- 2026-04-08T01:24:13Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.