Cyber Operations — 2026-04-10

FBI and Western Intelligence Partners Disrupt GRU Router Hijacking Network Spanning 18,000 Devices

The FBI, CIA, and Romanian SRI dismantled a GRU Unit 26165 (APT28/Forest Blizzard) network that hijacked over 18,000 TP-Link routers across 120+ countries since 2024. The GRU exploited CVE-2023-50224 to modify DNS settings, enabling adversary-in-the-middle attacks against encrypted traffic, including Microsoft Outlook Web Access credential harvesting. Over 200 organizations were breached across government, military, critical infrastructure, and energy sectors. The court-authorized FBI operation in 23 states neutralized compromised US routers while preserving user data.

Analysis
This updates prior reporting on the GRU Unit 26165 campaign. The new detail, Romanian SRI involvement alongside FBI and CIA, confirms the operation had multilateral intelligence coordination. The campaign exploiting consumer TP-Link routers for AitM attacks against Microsoft Outlook Web Access represents a low-cost, high-yield SIGINT technique for harvesting credentials at scale.

2 sources

The FBI and CIA say Russia was inside thousands of routers around the world - Deseret News
Operation Masquerade: FBI Disrupts Russian Router Hacking Campaign - Hackread