A Russian state-sponsored hacking group, known as APT28 or Fancy Bear, has been compromising home and small office routers to intercept user traffic. By altering the DNS settings of these routers, the group redirects internet traffic through their own servers, enabling them to spy on users. This campaign, uncovered by British security officials, highlights the threat of state-aligned cyber espionage to individual users and small organizations. The technical details of these attacks, outlined in a Microsoft blog, reveal a sophisticated operation that exploits vulnerabilities in SOHO routers1. The implications of this campaign are significant, as it shifts the threat model from traditional cybercrime to geopolitical espionage, requiring a different approach to mitigation and defense. This development matters to cybersecurity practitioners, as it underscores the need to reevaluate their threat assessment and response strategies to account for state-sponsored hacking groups.