Police warn of a Russian hack of thousands of TP-Link routers secretly around the world
German and international security services have issued a stark warning about a large-scale cyber espionage campaign carried out by the Russian hacker group APT28. The group is accused of secretly exploiting security flaws in internet routers around the world, including in Germany.
According to the Bundesamt für Verfassungsschutz (Federal Office for the Protection of the Constitution, BfV), working together with the Bundesnachrichtendienst (Federal Intelligence Service), the US FBI and other partner agencies, APT28 has infiltrated vulnerable routers made by the Chinese-founded company TP-Link. The attackers allegedly used these compromised devices to gather military information, government data and details about critical infrastructure.
Authorities report that several thousand TP-Link routers accessible on the public internet have been targeted in this campaign. Around 30 vulnerable devices have so far been identified in Germany. Those affected have already been contacted and given specific advice on how to close the security gaps, and many of the compromised routers have since been replaced.
TP-Link, which describes itself as one of the world’s leading providers of networking and smart communication solutions, has become a major player in markets such as Germany. Industry analyses indicate that a large share of companies using TP-Link hardware operate in the service and business sectors, and the brand is especially common among small and medium-sized enterprises worldwide. Technical databases such as Landbase list more than a hundred verified companies from various countries and industries using TP-Link equipment.
The hacker group, also known under the names “Fancy Bear” and “Forest Blizzard”, is widely believed to be linked to the Russian military intelligence service GRU. It has been blamed for several high-profile cyberattacks in Germany, including the attack on the Deutscher Bundestag (German federal parliament) in 2015, the SPD party headquarters in 2023, and an attack on German air traffic control two years ago. Authorities view the current router campaign as part of a broader, long-running Russian effort to conduct espionage and destabilise Western states through cyberspace.