NSA, FBI, and SBU Disrupt GRU Router Hijacking Network That Compromised 18,000 Victims Across 120 Countries

The NSA, FBI, and SBU, working with EU law enforcement, disrupted a GRU Unit 26165 (APT28/Fancy Bear) network that exploited SOHO routers since 2024 to conduct DNS hijacking. The DOJ announced a court-authorized operation to neutralize the US portion of the compromised network. Black Lotus Labs identified 18,000 victims across 120 countries. GRU actors redirected traffic through pre-deployed DNS servers to steal credentials and SSL/TLS-encrypted data, filtering for military, government, and critical infrastructure targets.