Published 2 months ago • loading... • Updated 2 months ago
Russian government hackers broke into thousands of home routers to steal passwords
Officials said the campaign hit more than 5,000 consumer devices and let hackers steal credentials and emails from targeted networks.
On Tuesday, the U.S. Justice Department and international partners executed "Operation Masquerade," a court-authorized disruption of a DNS-hijacking network controlled by Russia's GRU military intelligence unit.
Since at least 2024, Russian intelligence unit Fancy Bear has exploited vulnerabilities in home and office routers, redirecting internet traffic through malicious DNS servers to intercept passwords, authentication tokens, and sensitive emails.
Microsoft identified more than 200 organizations and 5,000 consumer devices impacted by the hacking operation, which primarily targeted TP-Link routers to compromise credentials connected to military, government, and critical infrastructure sectors worldwide.
The FBI and Ukraine's Security Service urged users to perform factory resets, update firmware, and disable remote management on devices to secure systems against future exploitation by state-sponsored actors.
Blocking more than 100 servers significantly weakened Russia's intelligence capabilities and prevented further interception of encrypted traffic, a persistent threat requiring continued vigilance from network defenders and device owners.