TP-Link WR841N

The TP-Link WR841N is a low-cost consumer SOHO router that APT28 (GRU Unit 26165) exploited via CVE-2023-50224 since 2024 to rewrite DNS settings for adversary-in-the-middle Microsoft 365 credential harvesting. The NCSC advisory published on 7 April 2026 identified the WR841N alongside other TP-Link models (WR840N, ARCHeR C7) and MikroTik devices as the hardware layer of the campaign.

The attack mechanism exploits CVE-2023-50224 to extract the router's credentials, then rewrites the primary DNS entry to an attacker-controlled server running dnsmasq-2.85, while keeping the secondary DNS legitimate. Only Microsoft's targeted domains resolve to the attacker; general browsing continues normally. The result is a highly targeted, invisible DNS interception that does not degrade the user's experience and produces no local indicator of compromise.

For enterprises with remote-working staff, the WR841N exemplifies the consumer-router risk class: millions of units deployed in home-working environments, rarely updated, with default admin credentials in many deployments. NCSC's guidance calls for firmware updates and changed default credentials as immediate mitigations; however, the operational reality for enterprise identity teams is that they cannot inventory or patch every router under a remote employee's desk.