Counterintelligence — 2026-04-08

FBI and International Partners Dismantle GRU DNS Hijacking Network in Operation Masquerade

The Department of Justice and FBI announced a court-authorized operation to neutralize a network of compromised SOHO routers used by GRU Military Unit 26165 (APT28/Fancy Bear) for DNS hijacking operations targeting military, government, and critical infrastructure personnel worldwide. The operation, dubbed Operation Masquerade, involved partners in 15 countries and affected over 5,000 devices across 200+ organizations. The GRU exploited known vulnerabilities in TP-Link routers since at least 2024, redirecting DNS requests to GRU-controlled servers.

Analysis
GRU Unit 26165 is the same unit responsible for the 2016 DNC hack and numerous subsequent operations. The 15-country takedown demonstrates FBI capacity to counter Russian cyber operations even with the Iran war consuming attention and 300+ national security agents departed. The TP-Link router exploitation since 2024 suggests the GRU infrastructure predates the current conflict.
2 sources
  1. Justice Department Conducts Court-Authorized Disruption of DNS Hijacking Network Controlled by a Russian Military Intelligence Unit - Department of Justice
  2. FBI Boston neutralizes U.S. portion of hacked routers by Russia in Operation Masquerade - WJAR/NBC10 Boston

View in full brief →

UNCLASSIFIED // OPEN SOURCE