Russian government hackers of the Fancy Bear group (APT 28), associated with the Russian GRU intelligence agency, captured thousands of home and small businesses worldwide for stealing codes and tokens. According to Tuesday's warning from the UK NCSC and Black Lotus Labs, they took advantage of uninformed routers MicroTik and TP-Link, redirecting traffic to fake websites. The attack affected at least 18,000 victims in 120 countries, including government agencies. Microsoft located over 200 organizations and 5,000 consumer devices affected, while the FBI confiscated campaign domains.