FBI Disrupts APT28-Linked Router Network Used for DNS Hijacking
Summary
The FBI says Operation Masquerade disrupted the U.S. portion of an APT28-linked network of compromised routers by collecting evidence, resetting DNS settings and blocking renewed access. Authorities recommend updating or replacing vulnerable routers and checking DNS and
Key points
- The DOJ and FBI carried out the court-authorized Operation Masquerade against the U.S. portion of a router network attributed to APT28.
- The article says APT28 exploited vulnerable SOHO routers, including TP-Link devices, to change DNS settings and redirect traffic.
- The reported activity enabled adversary-in-the-middle attacks targeting email services and harvesting credentials, authentication tokens and emails.
- The article identifies CVE-2023-50224 among vulnerabilities used to obtain router credentials and reconfigure DNS settings.
- The FBI says it collected evidence, restored legitimate DNS settings and blocked the actors from regaining access; users can reverse the remediation through factory resets or manual changes.
- Authorities recommend replacing unsupported routers, updating firmware, checking DNS settings, securing remote management and enabling MFA.
Article Details
- Event Type
- Court-authorized FBI and Department of Justice disruption of an APT28-controlled network of compromised SOHO routers.
- Impact
- APT28 used compromised routers to hijack DNS and intercept communications, harvesting passwords, authentication tokens, emails, and other sensitive data. The FBI reset DNS settings and blocked the actors’ access on affected devices in the U.S. portion of the network.
MITRE ATT&CK
CVE
People
Brett LeathermanFBI Assistant Director who discussed the global use of compromised routers for espionage.David MetcalfU.S. Attorney who publicly addressed the hijacking of Americans’ hardware and the government’s response.John A. EisenbergAssistant Attorney General who publicly described the GRU’s use of networks in American homes and businesses as a persistent threat.Ted DocksFBI Special Agent who stated that devices in more than 23 U.S. states had been weaponized.
Threat Actors
APT28The article attributes DNS hijacking, router compromise, and credential harvesting to APT28; it says the group is widely attributed to Russia’s GRU Unit 26165.Fancy BearNamed in the article as another name for APT28, which it attributes with compromising routers and conducting DNS hijacking and credential harvesting.GRU Unit 26165The article says APT28 is widely attributed to Russia’s GRU Unit 26165.SednitNamed in the article as another name for APT28, which it attributes with compromising routers and conducting DNS hijacking and credential harvesting.STRONTIUMNamed in the article as another name for APT28, which it attributes with compromising routers and conducting DNS hijacking and credential harvesting.
Vendors
MicrosoftThe campaign targeted Microsoft Outlook-related domains to harvest emails, passwords, and authentication tokens.TP-LinkRussian-linked APT28 has been exploiting vulnerable SOHO routers, notably TP-Link devices, to carry out large-scale DNS hijacking and adversary-in-the-middle operations that intercept communications and harvest
Products
Countries
RussiaDepartment of Justice and the FBI announced a court-authorized operation to disrupt a network of compromised routers controlled by Russia’s military intelligence unit, widely known as APT28.UkraineCluster Two: Involved forwarding DNS traffic through a layered infrastructure, with some operations targeting high-value devices, including those in Ukraine.United StatesRecent developments show that these operations have drawn direct intervention from U.S.