Cybersecurity Policy Report, Cyber Surveillance Operation Attributed to Russian Intelligence by U.K., (Apr 7, 2026)
Russian operatives are exploiting vulnerable routers to redirect and inspect Internet traffic for valuable intelligence targets, the United Kingdom’s National Cyber Security Centre (NCSC) warned today.
NCSC attributed the domain name system (DNS) hijacking operation to a Russian intelligence group known as Fancy Bear.
“DNS is what allows individuals to reach websites by typing familiar addresses, instead of associated IP addresses. In a DNS hijacking attack, actors interfere with this process to covertly send users to malicious websites designed to steal login details or other sensitive information,” NCSC explained in a news release.
“The DNS hijacking operations are believed to be opportunistic in nature, with the actor targeting a wide pool of victims and then likely filtering down for users of potential intelligence value at each stage of the exploitation chain,” according to the advisory, which offers information on how to detect and defend against the attacks.
“This activity demonstrates how exploited vulnerabilities in widely used network devices can be leveraged by sophisticated hostile actors,” said Paul Chichester, the NCSC’s director–operations. “We strongly encourage organisations and network defenders to familiarise themselves with the techniques described in the advisory and to follow the mitigation advice.”
News: InternationalLegislation DataSecurity