Loading story…
U.S. government reporting says operators linked to Russia's GRU are exploiting vulnerable routers to steal sensitive information from targeted networks. The activity was highlighted in an IC3 notice referenced by security community reporting, which attributes the intrusions to a Russian military intelligence actor using exposed or unpatched routing infrastructure as an access point for espionage.
Publicly available details in the referenced material remain limited, with no specific router models, malware families, indicators of compromise, or victim sectors disclosed in the summaries reviewed. Separate discussion in the same reporting stream noted that the Internet Bug Bounty program paused payouts after a surge in AI-generated vulnerability reports, but the principal security development was the government warning that compromised routers are being used for intelligence collection.
See which actors are running it and whether you're in range.
2 events from the most recent confirmed update back to the earliest known activity.
The Internet Bug Bounty program reportedly paused payouts following a surge in AI-generated vulnerability reports. The available reference is a secondary Reddit link post and does not specify when the pause began beyond the publication timeframe.
An IC3 notice dated 2026-04-07 warned that the Russian GRU was exploiting vulnerable routers to steal sensitive information. The available reference attributes the activity to the GRU but does not provide further technical details.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
reddit.com
Open sourcereddit.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A joint advisory from cybersecurity agencies in 12 countries warned that Russian state hackers linked to **FSB Center 16** are actively targeting vulnerable routers worldwide, focusing on devices exposed with default or weak SNMP credentials and community strings. The agencies said the actors can abuse SNMP to copy router configurations through OIDs and exfiltrate them over TFTP, while also exploiting older network-device flaws such as `CVE-2018-0171` on Cisco equipment. High-risk sectors identified in the warning include communications, defence, energy, financial services, government, and healthcare, and the activity follows formal UK and EU attribution of cyber-attacks on Poland’s energy infrastructure to the same Russian service. Separate reporting highlighted how compromised SOHO and home-office routers can be used for **DNS hijacking** that bypasses endpoint security and enables credential theft against remote workers. The attack path described combines documented Russian tradecraft, including APT28-linked router compromises, with downstream abuse such as redirecting traffic, harvesting **NTLMv2** hashes, and stealing Microsoft 365 credentials and tokens. Defenders were urged to harden or replace poorly secured routers, move to **SNMPv3**, disable unnecessary exposed services, monitor for unauthorized DNS resolver changes and NXDOMAIN spikes, and factory-reset suspected devices before rotating affected credentials.
Aug 15, 2026
The FBI and Justice Department said they disrupted multiple Russian GRU operations that hijacked small office/home office routers to conceal espionage activity, proxy malicious traffic, and steal credentials. In one court-authorized action, **Operation Dying Ember**, agents remotely accessed hundreds of compromised **Ubiquiti EdgeOS** routers infected with **Moobot**, deleted malware and related files, and temporarily changed firewall rules to cut off **APT28**—also tracked as **Fancy Bear**, **Sednit**, and **Forest Blizzard**—without disrupting normal device use. Officials said the botnet had originally been built by cybercriminals abusing internet-exposed routers with default administrator passwords before being repurposed by Russia’s **GRU Unit 26165**. U.S. authorities later said a related GRU campaign also compromised SOHO routers, including **TP-Link** devices, to alter **DNS** settings and conduct adversary-in-the-middle attacks against **TLS** sessions, including Outlook traffic, in operations affecting government, IT, telecommunications, and energy targets. In **Operation Masquerade**, the FBI sent commands to infected routers to collect forensic data and reset malicious DNS configurations, removing Russian access from the devices. Microsoft and U.S. agencies linked the activity to APT28 and warned that router compromises can enable traffic redirection, credential theft, malware delivery, and denial-of-service attacks, urging organizations to patch firmware, verify DNS settings, disable unnecessary remote management, and replace end-of-life hardware.
Jun 29, 2026
The FBI disrupted an **APT28** operation that compromised internet-connected routers to enable **DNS hijacking**, according to reporting citing U.S. and UK government findings. The campaign abused vulnerable edge devices to alter DNS settings and redirect traffic, giving the Russian state-linked group a way to intercept victim communications, harvest credentials, and support follow-on espionage activity. The activity was significant enough to prompt public warnings from the FBI and the UK **NCSC**, which described router exploitation as a key enabler for the hijacking operations. Government guidance tied the operation to exploitation of routers exposed to the internet and urged organizations to harden perimeter infrastructure by patching devices, restricting remote administration, rotating credentials, and reviewing DNS configurations for unauthorized changes. The disclosures underscore how Russian espionage actors continue to rely on stealthy network-level tradecraft—using compromised infrastructure rather than malware alone—to persist in victim environments and covertly redirect or monitor traffic.
Jun 29, 2026