Explore

FBI Remotely Patches Routers to Counter Russian GRU Espionage

FBI Remotely Patches Routers to Counter Russian GRU Espionage

The U.S. Federal Bureau of Investigation (FBI) has executed a remote patching operation on thousands of privately owned routers in the United States to remove malicious software installed by Russian military intelligence, known as the GRU. This operation, named Operation Masquerade, was conducted without the prior knowledge of the router owners but was authorized by a court. The GRU had exploited vulnerabilities in routers manufactured by TP-Link and Mikrotik to redirect user traffic to sites that could capture sensitive data such as login credentials. The FBI's intervention involved replacing the malicious DNS resolvers with legitimate ones provided by users' internet service providers. This action was part of a broader effort to counteract a campaign by the GRU, which had been active since at least 2024, targeting routers worldwide to alter DNS settings and redirect traffic to Russian-controlled servers.

Germany's Intelligence Agencies Warn of Russian APT28 Cyber Espionage Targeting Critical Infrastructure

Germany's Intelligence Agencies Warn of Russian APT28 Cyber Espionage Targeting Critical Infrastructure

Germany's domestic intelligence agency, the Federal Office for the Protection of the Constitution (BfV), has issued a warning about cyberattacks by the Russian state-linked hacker group APT28, also known as Fancy Bear. This group has been identified as compromising vulnerable TP-Link internet routers to spy on military, government, and critical infrastructure targets. The warning was issued in collaboration with Germany's foreign intelligence agency, BND, and the U.S. FBI. APT28 is attributed by Western governments to Russia's military intelligence service, the GRU. The group has previously conducted cyberattacks on Germany's parliament, the centre-left SPD political party, and air traffic control authorities.

FBI Dismantles Russia-Backed Espionage Network Targeting Global Routers

FBI Dismantles Russia-Backed Espionage Network Targeting Global Routers

The FBI, in collaboration with several cybersecurity organizations, has dismantled a Russia-backed espionage network that compromised over 18,000 routers worldwide. Known as Forest Blizzard or APT28, the group exploited vulnerabilities in TP-Link routers to conduct espionage activities. The operation, dubbed Operation Masquerade, involved resetting DNS settings to prevent further exploitation. The espionage network targeted government agencies and critical infrastructure sectors, posing a significant national security threat. The FBI's intervention has halted the campaign, with no evidence of compromised U.S. government agencies.

US Authorities Disrupt Russian Espionage Operation Using Hacked Routers

US Authorities Disrupt Russian Espionage Operation Using Hacked Routers

The US Justice Department and the FBI have announced the disruption of a Russian espionage operation involving hacked SOHO routers. The operation was linked to the threat actor known as APT28, Forest Blizzard, and Fancy Bear, believed to be backed by Russia's GRU. The hackers targeted vulnerable TP-Link and MikroTik routers, altering their DHCP and DNS settings to redirect traffic through their infrastructure. This adversary-in-the-middle attack allowed the capture of encrypted traffic, including passwords and emails. The attack exploited a known vulnerability, CVE-2023-50224, to control TP-Link routers. Microsoft identified over 200 organizations and 5,000 consumer devices affected by the attack, which began in August 2025.

US disrupts Russian military-run DNS hijacking network, Justice Department says

US disrupts Russian military-run DNS hijacking network, Justice Department says

WASHINGTON, April 7 (Reuters) - The U.S. Justice Department said on Tuesday it carried out a court-authorized disruption of a DNS hijacking network controlled by a Russian military intelligence unit.

German Intelligence Agency Warns of Russian APT28 Cyber Spying Targeting Critical Infrastructure

German Intelligence Agency Warns of Russian APT28 Cyber Spying Targeting Critical Infrastructure

Germany's domestic intelligence agency has issued a warning regarding cyberattacks by the Russian state-linked hacker group APT28, also known as 'Fancy Bear'. The group has reportedly compromised vulnerable TP-Link internet routers to spy on military, government, and critical infrastructure targets. The Federal Office for the Protection of the Constitution (BfV) collaborated with Germany's foreign intelligence agency, BND, and the US FBI to issue this warning. APT28 is attributed to Russia's military intelligence service, the GRU, and has previously targeted Germany's parliament, the centre-left SPD political party, and air traffic control authorities. The BfV noted that several thousand routers globally, including around 30 in Germany, were attacked, leading to some operators replacing affected routers.

Escalation in Iranian Cyber Attacks on U.S. Critical Infrastructure

Escalation in Iranian Cyber Attacks on U.S. Critical Infrastructure

U.S. cybersecurity, law enforcement, and intelligence agencies have reported an escalation in Iranian hacking campaigns targeting critical infrastructure sectors. These attacks focus on publicly exposed programmable logic controllers and supervisory control and data acquisition systems, aiming to cause disruptive effects within the United States. The targeted sectors include government services, water and wastewater systems, and energy. The advisory, issued by the FBI, NSA, Cybersecurity and Infrastructure Security Agency, and other federal bodies, highlights the operational disruptions and financial losses caused by these cyber operations.

Shaky ceasefire unlikely to stop cyberattacks from Iran-linked hackers for long

Shaky ceasefire unlikely to stop cyberattacks from Iran-linked hackers for long

An uncertain ceasefire between Iran and the U.S. and Israel may do little to stop cyberattacks from hackers allied with Tehran

Iran-linked Hackers Disrupt US Industrial Sites Amid Escalating Cyberattacks

Iran-linked Hackers Disrupt US Industrial Sites Amid Escalating Cyberattacks

Iran-linked hackers have successfully targeted and disrupted operations at multiple US industrial sites, including oil, gas, and water facilities. This marks an escalation in cyberattacks from Tehran since the onset of the US-Israeli conflict with Iran. The attacks have forced some sites to operate manually, leading to financial losses. The hackers have attempted to use destructive malware to delete data, although the success of these attempts remains unclear. The FBI and the Department of Homeland Security have issued urgent warnings to US critical infrastructure firms about these ongoing threats, which aim to cause disruptive effects within the United States.

Trump Administration Warns of Iran-Linked Cyber Threats to U.S. Water and Energy Systems

Trump Administration Warns of Iran-Linked Cyber Threats to U.S. Water and Energy Systems

The Trump administration has issued a warning regarding cyberattacks linked to Iran that are targeting critical U.S. infrastructure, including drinking water systems and the energy sector. The Environmental Protection Agency, the FBI, and other agencies released a joint statement highlighting the threat posed by these cyber actors. The attacks are reportedly aimed at technology used in water and sewer systems, as well as government facilities and services. Brett Leatherman, assistant director of the FBI’s cyber division, emphasized the importance of organizations being prepared to defend against these threats. The cyberattacks are similar to previous incursions by the group CyberAv3ngers, which has ties to Iran’s Islamic Revolutionary Guard Corps. The recent attacks have targeted logic controllers manufactured by Rockwell Automation Inc., causing operational disruptions and financial losses.

Iran-Linked Hackers Disrupt US Critical Infrastructure via PLC Attacks

Iran-Linked Hackers Disrupt US Critical Infrastructure via PLC Attacks

Several critical infrastructure organizations in the United States have been disrupted by cyberattacks linked to Iranian threat actors. According to a joint advisory from federal agencies including the FBI, CISA, NSA, EPA, DOE, and United States Cyber Command, these attacks have targeted operational technology (OT) devices across multiple sectors such as government services, water and wastewater systems, and energy sectors. The attackers have focused on internet-exposed programmable logic controllers (PLCs), particularly those manufactured by Rockwell Automation/Allen-Bradley. The advisory warns that the attacks have led to disruptions through malicious interactions with project files and manipulation of data on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays.

FBI Issues Warning on Foreign Mobile Apps, Highlighting Security Risks

FBI Issues Warning on Foreign Mobile Apps, Highlighting Security Risks

The Federal Bureau of Investigation (FBI) has released a public service announcement warning Americans about the potential dangers of using foreign-based mobile apps, particularly those developed in China. The announcement highlights concerns over data privacy and security, noting that many popular apps in the U.S. are subject to China's National Intelligence Law, which requires companies to provide data to the government. The FBI's warning is part of broader national security concerns that have previously led to actions such as the forced sale of TikTok's U.S. operations. The PSA advises users to be cautious about the permissions they grant to apps, as these can lead to data being stored on servers potentially accessible by foreign governments.