![\"A](\"https:\/\/www.europesays.com\/britain\/wp-content\/uploads\/2026\/04\/2_Wanted-hackers-coding-virus-ransomware-using-laptops-and-computers.jpg\")
<\/p>\nNotorious hackers linked to the Russian state have set their sights on the UK as they target vulnerable internet routers.<\/p>\n
Cyberspies known as APT28 linked to the Russian state have been targeting the UK’s vulnerable internet by hijacking legitimate websites(Image: Getty Images)<\/p>\n
Russian cyberspies<\/a> are targeting vulnerable internet routers around the UK to harvest \u2018intelligence\u2019, it has been revealed<\/p>\n The notorious hackers,<\/a> linked to Russia’s GRU military intelligence agency, are said to be exploiting a weakness in commonly used internet routers.<\/p>\n In January GCHQ\u2019s National Cyber Security Centre (NCSC) warned how Russian state-aligned ‘hacktivists’ <\/a>had been targeting local government websites.<\/p>\n And a few weeks ago they told how Messaging apps<\/a> such as WhatsApp<\/a>, Messenger and Signal. They said have been seeing “growing malicious activity from Russia-based actors using messaging apps to target high-risk individuals.”<\/p>\n But now they are warning for around two years these cyber spies have been casting their net even wider, potentially targeting the general public too.<\/p>\n APT 28 known as Friendly Bear has been on the hunt for sensitive information(Image: Getty Images\/iStockphoto)<\/p>\n They believe APT28 has been spreading out, to reach as many potential victims as possible before narrowing in on those with “potential intelligence value” since 2024.<\/p>\n APT28 stands for \u2018Advanced Persistent Threat\u2019 but they are more commonly known as Fancy Bear, the cyber spies who reportedly hacked the Democratic National Committee (DNC) servers during the 2016 US election campaign.<\/p>\n But according to our intelligence agency for several years they have been stealing users’ sensitive information in the UK by redirecting internet traffic so hackers can harvest people’s email login passwords and other sensitive data.<\/p>\n Hackers known as ‘Friendly Bear’ are believed to have been hitting the UK’s vulnerable internet routers for two years(Image: Getty Images)<\/p>\n They have been hijacking the domain name system (DNS), fooling internet users into thinking they are going to a legitimate website when they are in fact going to one controlled by the hackers.<\/p>\n NCSC director of operations Paul Chichester said: “This activity demonstrates how exploited vulnerabilities in widely used network devices can be leveraged by sophisticated hostile actors.<\/p>\n “We strongly encourage organisations and network defenders to familiarise themselves with the techniques described in the advisory and to follow the mitigation advice. The NCSC will continue to expose Russian malicious cyber activity and provide practical guidance to help protect UK networks.”<\/p>\n The NCSC set out a series of measures to protect systems, including using modern devices and keeping them updated. In January GCHQ said that hackers are persistently targeting UK organisations, “particularly local government and operators of critical infrastructure”. It recommended that local authorities review their defences and improve their cyber resilience.<\/p>\n Cyberspies have been targeting the UK havesting personal data (Image: Getty Images)<\/p>\n The hackers currently targeting the UKs websites are also called Unit 26165, Forest Blizzard, Pawn Storm, the Sednit Gang and Sofacy. These hackers were accused of using UK computers to attack the German parliament.<\/p>\n![\"Silhouette](\"https:\/\/www.europesays.com\/britain\/wp-content\/uploads\/2026\/04\/2_Online-crime.jpg\")
<\/p>\n![\"A](\"https:\/\/www.europesays.com\/britain\/wp-content\/uploads\/2026\/04\/2_Hacker-attacking-internet.jpg\")
<\/p>\n![\"A](\"https:\/\/www.europesays.com\/britain\/wp-content\/uploads\/2026\/04\/2_hack.jpg\")
<\/p>\n