Russian cyber actor APT28 exploit prone routers to hijack DNS, enabling adversary‑in‑the‑middle assaults and theft of passwords and authentication tokens.