Hacker group has been hijacking DNS traffic on D-Link routers for three months

https://www.zdnet.com/article/hacker-group-has-been-hijacking-dns-traffic-on-d-link-routers-for-three-months/

For the past three months, a cybercrime group has been hacking into home routers –mostly D-Link models– to change DNS server settings and hijack traffic meant for legitimate sites and redirect it to malicious clones.

Security

Hacker group has been hijacking DNS traffic on D-Link routers for three months

Why is it so hard for us to pay attention to cybersecurity?

Chinese companies have leaked over 590 million resumes via open databases

Over 540 million Facebook records found on exposed AWS servers

The attackers operate by using well-known exploits in router firmware to hack into vulnerable devices and make silent changes to the router's DNS configuration, changes that most users won't ever notice.

Targeted routers include the following models (the number to the side of each model lists the number of internet-exposed routers, as seen by the BinaryEdge search engine):

D-Link DSL-2640B - 14,327

D-Link DSL-2740R - 379

D-Link DSL-2780B - 0

D-Link DSL-526B - 7

ARG-W4 ADSL routers - 0

DSLink 260E routers - 7

Secutech routers - 17

TOTOLINK routers - 2,265