APT28 Hackers Breach UK Government Emails Using DNS Hijacking
APT28, also known as Fancy Bear, has successfully compromised the email accounts of UK government officials, including those within the Foreign Office. This incident highlights the ongoing cyber conflict between Russia and Western nations. The breach was identified by the UK’s National Cyber Security Centre (NCSC) on April 7, 2026, revealing that the group exploited vulnerabilities in internet routers to conduct DNS hijacking, allowing them to intercept login credentials without the victims' knowledge.
The NCSC assessed APT28 as an arm of Russia’s GRU military intelligence, specifically Military Unit 26165. Their operations follow a two-phase approach: initially, they conduct broad scans to identify vulnerable devices, followed by targeted attacks on high-value individuals such as government officials and diplomats. Previous campaigns by APT28 have affected over 18,000 networks during this initial scanning phase.
NCSC Director Paul Chichester emphasized the importance of securing network edge devices, recommending that organizations implement firmware updates, strict access controls, and two-step verification to mitigate risks. Russian cyber operations against UK government entities have been documented since at least 2018, with earlier attacks relying on spear-phishing tactics to trick employees into revealing their credentials.
The transition to DNS hijacking marks a tactical shift for APT28, moving away from phishing emails to directly compromising infrastructure. This method allows attackers to intercept legitimate traffic without the victim's awareness. The NCSC has clarified that APT28's primary aim is intelligence gathering, focusing on credential harvesting and email interception rather than financial theft.
Despite the NCSC's recommendations for basic cybersecurity measures, the fact that over 18,000 networks were compromised during APT28’s scanning phase underscores a significant gap between awareness and action in cybersecurity practices. The vulnerabilities that allowed Russian intelligence access to UK government emails are present across various networks, including those related to cryptocurrency infrastructure, raising broader concerns about cybersecurity in the digital age.
