What the APT28 router-hijacking advisory means for UK SMEs, and how to evidence it

The NCSC has named a Russian state-sponsored group exploiting small office routers to harvest credentials at scale. Jonathan Krause, founder of Forensic Control and former New Scotland Yard investigator, sets out what the advisory actually requires of UK SMEs, where Cyber Essentials does and does not reach, and what evidence you need to keep.

By Jonathan Krause | Founder, Forensic Control | 28 April 2026

What this means for you

If your business uses cloud services like Microsoft 365, has staff working from home, or supplies any government, defence, NHS, or large corporate customer, this advisory affects you. The technical fix on the router itself is not the hardest part. The harder questions are which routers Cyber Essentials actually covers in 2026 (the answer surprises most applicants), and whether you can prove what you did, when, if asked later by an insurer, a customer, or the regulator. This article walks through both.

What the NCSC advisory describes

On 7 April 2026, the National Cyber Security Centre (NCSC) published an advisory naming the Russian military intelligence group APT28, also known as Fancy Bear, as the actor behind a long-running campaign to compromise small office and home office (SOHO) routers. The campaign is attributed by the UK to Unit 26165 of Russia’s GRU 85th Main Special Service Centre.

The technique itself is straightforward. APT28 exploits known router vulnerabilities to overwrite the device’s Dynamic Host Configuration Protocol (DHCP) and Domain Name System (DNS) settings. Once those settings point to attacker-controlled servers, every device on the network inherits them. Lookups for services like Microsoft Outlook are quietly redirected, and an adversary-in-the-middle (AitM) page is served instead of the real one. Anyone who clicks past the certificate warning hands over their credentials and, importantly, their session tokens, which lets the attacker bypass multi-factor authentication entirely.

Paul Chichester, NCSC Director of Operations, said exploited vulnerabilities in widely used network devices can be leveraged by sophisticated hostile actors. The NCSC named the TP-Link WR841N and CVE-2023-50224 as one confirmed combination, with other TP-Link and MikroTik models also in scope.

Why this matters specifically for UK SMEs

The advisory is a UK government statement, not a wire-service story, and it is unusually specific about who is at risk. The activity is described as opportunistic: APT28 casts a wide net across SOHO routers, then filters for victims with intelligence value.

For a small or medium-sized enterprise, intelligence value is broader than it sounds. UK SMEs in the supplier chains of defence, logistics, professional services, energy, and technology sectors are all in scope, as is any organisation working with central government, the Ministry of Defence, or a National Health Service (NHS) trust. If a router on your network is compromised, you may not be the final target. You may be the route in.

Across the Cyber Essentials assessments Forensic Control has carried out in the last twelve months, almost every single applicant has at least one home-worker with associated routers. The most common finding is firmware years out of date, on a device the internet service provider (ISP) supplied at the start of a contract and has not touched since. Exposed remote management interfaces are less common than they were five years ago, but still present, usually because someone enabled remote admin to fix a problem and never turned it off. Default administrator credentials remain very common in consumer kits issued to remote staff who set it up themselves.

What Cyber Essentials does and does not require on home-worker routers

This is the part of the advisory where the line between what the scheme covers and what it does not has to be drawn precisely. The position under Cyber Essentials Requirements for IT Infrastructure v3.3, in force from 27 April 2026, and confirmed by IASME’s own guidance on firewalls and routers, is unambiguous in a way that surprises a lot of applicants.

If a home or remote worker uses a router supplied by their ISP, or one they have bought themselves, that router is out of scope for Cyber Essentials. The firewall control transfers, in those cases, to the software firewall on the home worker’s device, the laptop, desktop, tablet, or phone. The applicant organisation is not required to manage, patch, or harden the ISP router. It is required to ensure the host-based firewall on the in-scope device is configured securely. That is the rule, and it is the rule a v3.3 assessor will mark against.

If, on the other hand, the applicant organisation has supplied the router to the home worker, that router is in scope. Every Cyber Essentials firewall control applies to it. So does the v3.3 patching rule: critical or high-risk vulnerabilities in router firmware (CVSS v3 base score of 7 or above, or vendor-classified as critical or high risk) must be patched within 14 days of release, and as of v3.3 a no answer to that question is an automatic assessment failure.

The practical implication is that being able to say we are Cyber Essentials certified is not, on its own, an answer to the threat the advisory describes. The scheme’s scope rule means that the very devices APT28 is exploiting most successfully, ISP-supplied SOHO routers in remote-worker homes, sit just outside the boundary an organisation is being assessed against. That is not an oversight. It reflects a sensible decision that an applicant cannot reasonably be held responsible for hardware they do not own, manage, or have admin credentials for. But it does mean that compliance with v3.3 is necessary, and not sufficient, for the threat profile the advisory describes. The Mythos Preview discussion in our previous article on AI-accelerated vulnerability discovery explains why the wider trend is accelerating, not slowing.

How to evidence the response, not just perform it

Calling the response evidence is deliberate. If your organisation is breached via a compromised router, the question your insurer, your customers, and potentially the Information Commissioner’s Office (ICO) will ask is not whether you took action. It is whether you can prove what action you took, when, and to what standard. The answer depends on which of the two scope categories the router sat in, and the FAQ at the end of this article sets out the artefacts in detail for each.

When we are called in after a suspected router compromise, the first question is almost always whether the device is still in the state it was in at the time of the incident. In more cases than not, it is not. Either the router has been factory-reset by the user in an attempt to clean it, or it has been replaced entirely and the original sent back to the ISP. Either way, the volatile evidence that would tell us what the device was doing, where it was sending traffic, and which credentials passed through it has gone. Where logging was enabled at all, it was usually held only on the device itself, with retention measured in hours or days rather than weeks. Recovery is sometimes possible from upstream sources, ISP netflow records, cloud authentication logs showing impossible-travel signatures, mail-server headers, but the work takes substantially longer and costs materially more than it would if a logging baseline had been in place from the start. The single biggest predictor of how quickly and cheaply we can answer the questions an insurer or the ICO will ask is whether the organisation captured and preserved router configuration and logs before the incident, not after.

The Association of Chief Police Officers (ACPO) principles of digital evidence still govern how that material has to be captured and preserved if it is going to support an investigation or a regulatory submission. That work is not something most SMEs are equipped to do under their own steam, which is why having a digital forensics retainer in place before an incident, rather than scrambling for one during it, materially changes the outcome.