Fancy Bear Abuses EdgeRouters, Cloud for Stealthy Cyberattacks

Key Takeaways

• The Russian state-sponsored hacking group Fancy Bear (APT28) has significantly evolved its attack methods, now leveraging compromised Ubiquiti EdgeRouters, MikroTik, and TP-Link devices, alongside various cloud services, to establish highly stealthy command-and-control (C2) infrastructure.
• APT28 is moving away from traditional infrastructure, instead hijacking consumer-grade routers to create a distributed network that blends malicious traffic with legitimate internet activity, making detection extremely difficult.
• The group has refined its toolkit, employing short-lived, single-purpose malware and even experimenting with AI-driven infostealers like LameHug to generate attack commands dynamically.
• This new approach has impacted at least 200 organizations and 5,000 consumer devices across 120 countries, primarily targeting foreign ministries, law enforcement, and IT hosting providers.
• Defenders should prioritize router security, implement strong multi-factor authentication, and regularly audit cloud service permissions to mitigate these advanced threats.

Fancy Bear Shifts Tactics: Abusing EdgeRouters and Cloud for Covert Operations

The notorious Russian state-sponsored hacking collective, known interchangeably as Fancy Bear, APT28, or Strontium, has adopted a sophisticated and elusive strategy to conduct cyberattacks, according to a recent, comprehensive report by cybersecurity researchers. Identified as GRU Unit 26165 by military intelligence, this persistent threat actor is now exploiting compromised Ubiquiti EdgeRouters and various legitimate cloud platforms to construct a clandestine command-and-control (C2) infrastructure, enabling it to evade conventional detection methods.

Instead of relying on easily identifiable, traditional server infrastructure, the group has pivoted to hijacking home routers and other small office/home office (SOHO) devices. This tactic allows Fancy Bear to build a “shadow network” that is exceedingly difficult to trace, as its malicious traffic is camouflaged within the normal internet activity of legitimate users.

For more than two decades, APT28 has consistently targeted high-value entities, including government bodies, defense contractors, diplomatic missions, and critical infrastructure, with a particular focus on NATO member states and Ukraine. The group operates under a multitude of aliases, such as Forest Blizzard, Sofacy, Pawn Storm, and Sednit. What makes their latest campaign particularly concerning is the unprecedented level of stealth achieved by blending attack traffic with everyday internet usage.

Analysts from Sekoia, who have diligently tracked APT28 for several years, pinpointed a significant architectural shift in how the group manages its attack infrastructure. Sekoia’s report, shared with Cyber Security News (CSN), indicates that APT28 has largely transitioned its operations from rented virtual private servers to compromised SOHO routers and edge devices, which now serve as their primary command centers.

The sheer scale of this repurposed infrastructure is alarming. At its zenith in December 2025, researchers observed over 18,000 unique IP addresses spanning 120 countries communicating with APT28-controlled servers. This expansive network impacted approximately 200 organizations and 5,000 consumer devices, with victims predominantly comprising foreign ministries, law enforcement agencies, and IT hosting providers.

Beyond infrastructure, APT28’s tradecraft has also undergone a sharp evolution. The group has moved away from stable, long-term malware frameworks, opting instead for deploying short-lived, single-purpose tools that are discarded immediately upon exposure. Furthermore, the group has been observed experimenting with an AI-driven infostealer named LameHug, which dynamically queries a live AI model to generate attack commands, showcasing a cutting-edge approach to operational security. This combination of disposable tooling, cloud service abuse, and router hijacking positions APT28 as one of the most formidable and adaptable threat actors currently operating.

Router Hijacking for Stealthy Operations

A pivotal tactical shift observed is APT28’s appropriation of consumer-grade routers. In April 2022, the group commandeered a criminal botnet previously built with the MooBot malware, seizing control of hundreds of Ubiquiti EdgeRouters. This botnet served a triple function: relaying stolen authentication hashes to Microsoft Exchange, hosting phishing pages on residential IP addresses, and executing custom Python scripts directly on the compromised routers.

Despite the FBI’s Operation Dying Ember successfully dismantling this particular network in 2024, the persistence of the threat was evident. Over 350 datacenter servers continued to attempt communication with the attacker’s infrastructure post-takedown, highlighting the inherent difficulty in completely eradicating such deeply embedded botnets.

In 2026, APT28 expanded this strategy with a campaign dubbed FrostArmada, this time targeting MikroTik and TP-Link routers. The attackers manipulated DNS settings on these devices to reroute network traffic through their own command-and-control servers. Consequently, every device connected to the affected networks unknowingly funneled its login requests through APT28 nodes, facilitating the silent theft of credentials and OAuth tokens for services like Microsoft 365.

Cloud Services as a Covert Command Channel

In addition to router hijacking, APT28 has been observed routing its malware communications through legitimate cloud platforms to further obscure its activities. During Operation Phantom Net Voxel, the group deployed a bespoke C++ backdoor known as BeardShell, which utilized a cloud storage API as its command channel. This sophisticated method allows malware traffic to appear as legitimate connections to trusted cloud services, making it exceedingly difficult for security monitoring tools to differentiate malicious activity from benign network traffic.

The group demonstrates a high degree of agility in its cloud operations, readily swapping cloud providers. Researchers noted the reuse of the same attack chain with different file-hosting platforms within months, confirming that rotating cloud backends is now a standard operating procedure for APT28. Furthermore, a keylogger named Slimagent, discovered on the same operator infrastructure, exhibited direct code lineage from X-Agent, APT28’s signature implant used for over a decade, indicating a continuous evolution of their core toolset.

What You Should Do

• Update Router Firmware: Regularly check for and install the latest firmware updates for all routers, especially Ubiquiti EdgeRouters, MikroTik, and TP-Link devices.
• Change Default Credentials: Immediately change default usernames and passwords on all network devices, including routers, to strong, unique credentials.
• Disable Unused Features: Turn off any unused remote management features or services on your router to reduce the attack surface.
• Implement Multi-Factor Authentication (MFA): Enforce phishing-resistant multi-factor authentication (MFA) for all cloud services and critical accounts to prevent credential theft.
• Audit OAuth Token Permissions: Regularly review and audit OAuth token permissions for cloud applications to ensure no excessive or unauthorized access is granted.
• Monitor DNS Settings: Periodically verify your network’s DNS settings to ensure they haven’t been maliciously altered.
• Network Segmentation: Implement network segmentation to limit the lateral movement of attackers if a device is compromised.
• Educate Users: Train employees and home users on identifying phishing attempts, especially those targeting login credentials for cloud services.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.