INTEL_REPORT
Ars Technica — Security · published 4/8/2026, 11:00:08 AM · TLP amber
Summary
Ingested excerpt (first ~500 chars of normalized text).
Thousands of consumer routers hacked by Russia's military End-of-life routers in homes and small offices hacked in 120 countries. The Russian military is once again hacking home and small office routers in widespread operations that send unwitting users to sites that harvest passwords and credential tokens for use in espionage campaigns, researchers said Tuesday. An estimated 18,000 to 40,000 consumer routers, mostly those made by MikroTik and TP-Link, located in 120 countr…
https://arstechnica.com/security/2026/04/russias-military-hacks-thousands-of-consumer-routers-to-steal-credentials
sha256:77a5ad4f6cf150e428ff01999679d3ae23dd82b200be364241ed056ee4a97ccf
What we pulled out
Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).
Indicators
Linked with report → mentions → indicator. Values open the indicator workspace.
No indicators linked for this report.
Malware families
Allowlist token matches only.
Threat actors mentioned
Allowlist mentions — not a formal attribution verdict.
ATT&CK techniques
MITRE IDs referenced in text and present in local technique table.
CONTINUE INVESTIGATION
High-signal pivots without leaving the thread you started in search.
Browse the report corpus.