Adversary Intelligence — 2026-06-12

GRU-Linked APT28 Pivots to MooBot Botnet and Compromised EdgeRouters for NATO Targeting

BLUFAllied disruption of APT28's EdgeRouter infrastructure is likely by late September 2026, given the multi-agency coordination pattern that historically precedes formal takedown operations.

Sekoia, publishing on June 11 as part of a coordinated disclosure with the FBI and partner agencies, documented that APT28 migrated core operational infrastructure to hundreds of compromised Ubiquiti EdgeRouters running the MooBot botnet, using them for NTLMv2 hash relay, traffic proxying, and phishing page hosting against NATO and Ukrainian targets 1. The network spans roughly 18,000 unique IP addresses across more than 120 countries, touching approximately 200 organizations and 5,000 consumer devices 1. A parallel FrostArmada campaign reprogrammed MikroTik and TP-Link routers by rewriting DHCP and DNS settings to route traffic through APT28-controlled resolvers for adversary-in-the-middle operations against Outlook Web Access 1. A joint FBI, NSA, CISA, and NCSC advisory formally documented the EdgeRouter compromise operations in February 2024 2.

Analysis
A coordinated allied disruption of APT28's MooBot/EdgeRouter infrastructure is likely by September 30, 2026. High confidence in that assessment rests on multi-agency coordination between Sekoia, the FBI, and partner agencies, which in prior APT28 exposure cycles has reliably served as the public precursor to formal technical action. The June 11 Sekoia disclosure, structurally independent from the February 2024 FBI/NSA/CISA/NCSC joint advisory, confirms the group reconstituted after April's Operation Masquerade on a larger EdgeRouter-based botnet spanning 18,000 IPs, expanding the operational template rather than abandoning it. The attributed scale likely overstates purposeful NATO targeting; a portion of that footprint reflects opportunistically co-opted MooBot nodes rather than deliberate APT28 construction. Disruption by September shifts defenders from active EdgeRouter mitigation to tracking the group's next infrastructure pivot; a miss sustains current patching and hunting requirements through year-end.

3 sources

APT28, an evolution of tradecraft - Sekoia
GRU-Linked APT28 Uses MooBot Botnet and Compromised EdgeRouters for Cyber Operations - GBHackers
Russian Cyber Actors Use Compromised Routers to Facilitate Cyber Operations - FBI/NSA/CISA/NCSC