Back Devdiscourse

Operation Masquerade: U.S. Disrupts Russian DNS Hijacking Network

Devdiscourse • April 7, 2026

The United States Justice Department has successfully dismantled a DNS hijacking network operated by Russia's Main Intelligence Directorate of the General Staff (GRU) Military Unit 26165. This operation, known as 'Operation Masquerade,' targeted thousands of routers globally, capturing sensitive information, including passwords and emails.

According to the Justice Department, the GRU used compromised routers to facilitate hijacking attacks against military, government, and critical infrastructure sectors worldwide. The FBI, in collaboration with international partners from 15 countries, identified and reset these compromised routers to halt the ongoing espionage activities.

Microsoft and Lumen Technologies' Black Lotus Labs revealed that over 200 organizations and 5,000 devices were affected by the network. Despite no response from the Russian Embassy in Washington, global advisories have been issued, emphasizing the persistent threat of Russia's cyber programs.

(With inputs from agencies.)

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

APT28 Exploits Vulnerable Routers for Global DNS Hijacking Campaign Russian cyber group APT28, also known as Fancy Bear, has been exploiting vulnerabilities in TP-Link and MikroTik routers to conduct large-scale DNS hijacking operations. This campaign, which has affected over 18,000 devices across 120 countries, allows attackers to intercept internet traffic and steal sensitive information, including passwords and access tokens. The group has been leveraging known vulnerabilities, such as CVE-2023-50224, to modify DNS settings and redirect users to malicious servers. The U.S. Department of Justice and FBI recently announced the takedown of a significant portion of this infrastructure in an operation dubbed 'Operation Masquerade.' The attacks have primarily targeted military, government, and critical infrastructure sectors. Authorities are urging users to update their devices and follow security best practices to mitigate risks. The NCSC and Microsoft have issued advisories detailing the ongoing threat and the need for immediate action. 100 sources 78

Extracted Entities

Operation Masquerade: U.S. Disrupts Russian DNS Hijacking Network

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Campaigns (1)

Countries (2)

Industries (1)