Is your business router safe? What the NCSC's April 2026 warning means

Most small businesses think about laptops, passwords and email when they think about security. The grey box on the shelf that connects everything to the internet gets far less attention. In April 2026 the National Cyber Security Centre (NCSC) published an advisory that put that box in the spotlight. This post explains what it said, in plain English, and what a small business can sensibly do this week.

What the NCSC actually reported

The NCSC's alert, published on 7 April 2026 and updated on 13 May 2026, describes how a state-linked group known as APT28 exploited small office and home office (SOHO) routers. The NCSC says the activity has run from 2024 into 2026. We are not here to take sides in anything geopolitical, and the useful part for a business owner is the method, because the same trick could be used by anyone.

According to the NCSC, the attackers used publicly known weaknesses to get into routers, then changed the router's DHCP and DNS settings so that it pointed at DNS servers they controlled. DNS is the internet's address book: it turns a name like an email login page into the address a device should connect to. Because laptops and phones on the network normally inherit those settings from the router, every device behind it was affected.

The NCSC explains that lookups for domains tied to email or login services were sent to addresses the attackers controlled, while other requests went to the genuine addresses. That selective behaviour makes the problem harder to spot, because most websites still work normally. The aim was to carry out adversary-in-the-middle attacks, where the attacker sits between you and a service to harvest passwords, tokens and other credentials.

Which routers were involved

The NCSC names the TP-Link WR841N as its main example and says the attackers likely used a flaw tracked as CVE-2023-50224, which lets an unauthenticated attacker obtain credentials through crafted web requests. The advisory lists 23 targeted TP-Link models and says that list is likely not exhaustive. It also describes activity involving MikroTik routers, often in Ukraine.

The NCSC assesses the activity as likely opportunistic. In other words, the attackers appear to cast a wide net and then narrow down to users of interest, rather than picking out small businesses by name. Microsoft, as reported by The Register, said that over 200 organisations and 5,000 consumer devices were impacted by the malicious DNS infrastructure, and that its telemetry showed no compromise of Microsoft-owned assets or services.

It is worth being clear about what this does and does not mean. It does not mean every TP-Link or MikroTik router is compromised. It means that older, unpatched and exposed routers are an attractive target, and that a compromised router can quietly undermine accounts that are otherwise well protected.

What the NCSC recommends

The advisory is written for organisations and network defenders, and it does not include a section aimed specifically at small businesses. Its general mitigations are still a useful checklist:

• Protect management interfaces. The NCSC states that management interfaces must never be exposed to the internet.
• Keep systems up to date. Use the latest supported versions and apply security updates promptly. Replace out-of-date platforms, and put short-term protections in place if replacement cannot happen straight away.
• Use multi-factor authentication. Two-step verification reduces the damage if a password is stolen.
• Monitor and log. Keep the data you need to work out what happened if something goes wrong.
• Help staff to report. People should know how to report anything suspicious, and the NCSC advises never to punish users for clicking phishing links or opening attachments.

A practical checklist for this week

The NCSC's separate small business guide says that many of its recommendations take as little as five minutes and need no technical expertise. These router checks follow the same spirit. The steps below are our own practical reading of the advisory's themes rather than a quotation from it, so check your router maker's documentation for the exact menus.

• Find out what you have. The model number is usually printed on a label on the router. If your broadband provider supplied it, ask them who maintains and updates it.
• Check it is still supported. Look on the manufacturer's website for your exact model. If the maker no longer issues security updates, the NCSC's advice to replace out-of-date platforms applies.
• Install the latest firmware. Router firmware is the software inside the box. Check whether your router updates itself, and if not, make updating a diary task.
• Switch off remote administration. If you do not need to log in to the router from outside your premises, make sure that option is off, in line with the NCSC's point about management interfaces.
• Change the admin password. The password for the router's settings page should not be the factory default, and should be different from your Wi-Fi password.
• Look at the DNS settings. Log in to the router and see which DNS servers are configured. If you see addresses you do not recognise and did not set, treat that as a warning sign and ask your IT provider or the router maker for help.
• Turn on two-step verification for email and cloud accounts, so a stolen password alone is not enough.

What about staff working from home?

The advisory is about small office and home office equipment, and that includes the router in a director's spare room. If your team reads company email from home, their router sits between them and your systems. You cannot manage their equipment, but you can set a simple expectation: staff should keep home routers updated, replace ones that are no longer supported, and use two-step verification on every work account. Our post on staff using personal phones for work covers a related set of habits.

Where the wider discussion stands

The commentary we found, from trade press and local business-security bodies passing the warning on, was calm and practical rather than alarmist, with the focus on knowing which router you have and keeping it updated.

What to do if you are unsure

If checking a router feels beyond you, you are not alone, and it is a reasonable thing to ask an IT provider to do. Make sure someone owns the job and that it is written down: what the device is, when it was last updated, and when it will need replacing. If you have already had a security incident, the NCSC has separate response and recovery guidance for small organisations.

If you would like help reviewing how your business network, cloud accounts and devices fit together, our cloud and security team can talk it through with you in plain language.