Adversary Intelligence — 2026-04-09

GCHQ Exposes GRU Unit 26165 Campaign Hijacking Home Routers Across 120 Countries for Espionage

The UK National Cyber Security Centre, part of GCHQ, publicly attributed a broad router-hijacking campaign to GRU Unit 26165 (APT28/Fancy Bear) with its highest confidence rating. The operation compromised TP-Link and MikroTik routers across 120 countries by exploiting weak SNMP configurations, enabling DNS hijacking and adversary-in-the-middle attacks to intercept credentials and authentication tokens. NSA and FBI co-sealed the advisory. The campaign was initially opportunistic, scanning widely for vulnerable devices, before narrowing to intelligence-priority targets in military, government, and critical infrastructure sectors.

Analysis
This is the second distinct APT28 campaign disclosed this week alongside PRISMEX, suggesting GRU Unit 26165 is running parallel operations across different target sets. The router campaign's shift from opportunistic scanning to intelligence-priority targeting mirrors the GRU's operational pattern of casting wide nets before narrowing to high-value collection. The FBI's active disruption via Operation Masquerade represents an increasingly aggressive U.S. counter-cyber posture.

2 sources

Russian government hackers broke into thousands of home routers to steal passwords - TechCrunch
US operation evicts Russia from hacked SOHO routers used to breach critical infrastructure - Cybersecurity Dive