FBI Disrupts GRU Router Espionage Network in Operation Masquerade, 18,000 Devices Compromised

FBI disrupted a GRU cyberespionage campaign that compromised 18,000+ TP-Link routers worldwide in Operation Masquerade, coordinated with NSA and 15 allied intelligence agencies. GRU's 85th Main Special Service Center (APT28) modified router DNS settings to intercept encrypted traffic including passwords, authentication tokens, and emails via adversary-in-the-middle attacks. FBI Cyber Division Assistant Director Brett Leatherman said the attack was virtually invisible to end users because it exploited router tools rather than deploying malware. This is the FBI's fourth takedown of GRU cyber infrastructure since 2018.