The FBI and CIA, alongside many Western intelligence allies, became aware of a Russian cyber breach targeting thousands of routers to obtain intelligence information. The U.S. intelligence agencies announced on Thursday that Operation Masquerade neutralized American routers compromised by Russia’s military intelligence agency, the GRU and its cyber unit, known as “Fancy Bear.”
“Since at least 2024, GRU actors have exploited known vulnerabilities to steal credentials for thousands of TP-Link routers worldwide. The actors then accessed many of these compromised routers without authorization and manipulated their settings to redirect DNS requests to GRU-controlled servers,” per a press release from the Department of Justice. “The GRU actors harvested unencrypted passwords, authentication tokens, emails, and other sensitive information from devices on the same network as the compromised TP-Link routers.”
Hijackings occurred around the globe, including in Canada, Finland, Latvia, Lithuania, Norway, Poland, Portugal, Romania and others.
Nicușor Dan, president of Romania, described the cyberattack as a continuous “hybrid war” on X, urging nations to better protect their cybersecurity.
The U.S. government said it ran technical operations on certain TP-Link routers, kicking out the hacker but leaving everything else untouched.
Officials shared the following protocol for owners of small office/home office routers:
- Replace end-of-life and end-of-support routers.
- Upgrade to the latest available firmware.
- Verify the authenticity of DNS resolvers listed in router settings.
- Review and implement firewall rules to prevent the unwanted exposure of remote management services.
Special Agent Ted Docks of the FBI’s Boston Field Office, which headed Operation Masquerade, said, “The FBI utilized cutting edge technology and leveraged our private sector and international partners to unmask this malicious activity and remediate routers. Now we’re asking everyone who has a router to secure it, update its firmware, and replace it if needed. By working together, we can guard against nefarious nation state actors trying to compromise our national security,” per the press release.