FBI disrupts GRU router botnets used for espionage and DNS hijacking

The FBI and Justice Department said they disrupted multiple Russian GRU operations that hijacked small office/home office routers to conceal espionage activity, proxy malicious traffic, and steal credentials. In one court-authorized action, Operation Dying Ember, agents remotely accessed hundreds of compromised Ubiquiti EdgeOS routers infected with Moobot, deleted malware and related files, and temporarily changed firewall rules to cut off APT28—also tracked as Fancy Bear, Sednit, and Forest Blizzard—without disrupting normal device use. Officials said the botnet had originally been built by cybercriminals abusing internet-exposed routers with default administrator passwords before being repurposed by Russia’s GRU Unit 26165.

U.S. authorities later said a related GRU campaign also compromised SOHO routers, including TP-Link devices, to alter DNS settings and conduct adversary-in-the-middle attacks against TLS sessions, including Outlook traffic, in operations affecting government, IT, telecommunications, and energy targets. In Operation Masquerade, the FBI sent commands to infected routers to collect forensic data and reset malicious DNS configurations, removing Russian access from the devices. Microsoft and U.S. agencies linked the activity to APT28 and warned that router compromises can enable traffic redirection, credential theft, malware delivery, and denial-of-service attacks, urging organizations to patch firmware, verify DNS settings, disable unnecessary remote management, and replace end-of-life hardware.