SSU, FBI and EU partners expose large

Mezha.Ua • April 8, 2026

The Security Service of Ukraine, together with the FBI , Polish counterintelligence agencies and EU law enforcement agencies, conducted a joint cyber operation against Russian intelligence activities.

The operation revealed that Russian military intelligence was massively hacking and office Wi-Fi routers in Ukraine, the EU and the US. The devices with outdated security settings were targeted.

After gaining access to the routers, the attackers redirected Internet traffic through their own network of DNS servers. This allowed them to intercept passwords, authentication tokens, emails and other data, even if they were transmitted via secure protocols.

The collected information was planned to be used for cyberattacks, information operations and intelligence. Particular attention was paid to the data of employees of government agencies, the military, and defence industry enterprises.

As part of the operation, more than 100 servers were blocked and hundreds of routers in Ukraine were taken out of enemy control. This reduced the capabilities of Russian intelligence and prevented the potential disruption of equipment.

The SBU reported that the investigation is ongoing. Law enforcement officers are working to identify all those involved in the cyberattacks.

The agency also urged users to check their routers, update software and change access passwords. In the absence of security updates, it is recommended to replace the device with one supported by the manufacturer. It is also recommended to disable remote management access from the Internet and check the settings for suspicious changes.

Read also: FBI reports thousands of Signal accounts hacked by Russian hackers

Hackers from Russia hacked Ukrainians' iPhones with a new Darksword tool: quickly stole data and disappeared

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

APT28 Exploits Vulnerable Routers for Global DNS Hijacking Campaign Russian cyber group APT28, also known as Fancy Bear, has been exploiting vulnerabilities in TP-Link and MikroTik routers to conduct large-scale DNS hijacking operations. This campaign, which has affected over 18,000 devices across 120 countries, allows attackers to intercept internet traffic and steal sensitive information, including passwords and access tokens. The group has been leveraging known vulnerabilities, such as CVE-2023-50224, to modify DNS settings and redirect users to malicious servers. The U.S. Department of Justice and FBI recently announced the takedown of a significant portion of this infrastructure in an operation dubbed 'Operation Masquerade.' The attacks have primarily targeted military, government, and critical infrastructure sectors. Authorities are urging users to update their devices and follow security best practices to mitigate risks. The NCSC and Microsoft have issued advisories detailing the ongoing threat and the need for immediate action. 100 sources 78

Extracted Entities

SSU, FBI and EU partners expose large

The full story

Extracted Entities

Attack Types (1)

Countries (2)

Industries (1)

Malware (1)

MITRE ATT&CK (1)