FBI Takes Down Russian Campaign That Compromised Thousands of Routers

In a major counter-cyberespionage action dubbed “Operation Masquerade,” the U.S. Justice Department and the FBI successfully neutralized a global network of compromised small office/home office (SOHO) routers.

The infrastructure was controlled by Russia’s Main Intelligence Directorate (GRU) to execute sophisticated Domain Name System (DNS) hijacking attacks against high-value intelligence targets.

The Threat Actor and Attack Chain

The campaign is officially attributed to GRU Military Unit 26165, widely known in the cybersecurity community as APT28, Fancy Bear, Sofacy Group, or Forest Blizzard.

Since at least 2024, these state-sponsored hackers exploited known vulnerabilities in thousands of TP-Link routers worldwide, stealing credentials to gain unauthorized access to the devices.

Once inside, the threat actors manipulated the routers’ DNS settings, forcing them to route traffic through malicious, GRU-controlled DNS resolvers.

While the initial router compromises were indiscriminate, the GRU used automated filtering to identify traffic belonging to military, government, and critical infrastructure personnel.

For these specific targets, the malicious resolvers served fraudulent DNS records that spoofed legitimate services, such as Microsoft Outlook Web Access.

This enabled “Actor-in-the-Middle” attacks on encrypted network traffic, allowing the hackers to silently harvest unencrypted passwords, authentication tokens, and sensitive emails from any device connected to the infected router network.

This predatory approach turned everyday household and small business internet equipment into active tools for foreign espionage.

To stop the espionage operations, the FBI secured court authorization to actively intervene. They deployed specially developed commands directly to the compromised routers located within the United States.

This remote operation collected forensic evidence, purged the malicious GRU DNS resolvers, restored legitimate ISP-provided DNS settings, and blocked the attackers’ original access routes.

The intervention was extensively tested by MIT Lincoln Laboratory and successfully locked out the threat actors without disrupting the legitimate owners’ internet functionality or accessing their private data.

Private sector partners, including Microsoft Threat Intelligence and Lumen’s Black Lotus Labs, provided crucial technical support during the discovery phase.

Remediation and Mitigation Steps

While the FBI neutralized the immediate threat on U.S. devices, the risk remains for unpatched hardware globally.

Security agencies urge all SOHO router owners to take immediate action to secure their networks:

• Replace any end-of-life or end-of-support routers that no longer receive security updates.
• Update your router firmware to the latest available version via the manufacturer’s official website.
• Manually verify the authenticity of the DNS resolvers listed in your router’s administrative settings.
• Implement strict firewall rules to prevent the unwanted exposure of remote management services to the public internet.

The FBI is currently working with Internet Service Providers to notify users whose devices were remediated during the operation.

Users who suspect their router has been compromised should reset the device to factory defaults, apply the latest security patches, and report the incident to the FBI’s Internet Crime Complaint Center (IC3).

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.