A large-scale network of internet routers compromised by Russian hacking group APT28 to harvest credentials from victims of intelligence value has been taken down in the US.
The US Department of Justice (DoJ) announced on April 7, that it teamed up with the FBI to neutralize the US portion of the domain name system (DNS) hijacking network, which spanned across over 23 US states.
The scheme was also detailed on April 7 in reports by both the UK’s National Cyber Security Centre (NCSC) and Microsoft Threat Intelligence.
In several campaigns dating back to 2024, APT28 has been exploiting vulnerabilities in small office/home office (SOHO) routers – and especially TP-Link routers – to redirect traffic through attacker-controlled DNS servers and steal credentials from targeted organizations.
Both the UK and US government agencies attributed APT28 to Russia’s Main Intelligence Directorate of the General Staff (GRU) Military Unit 26165.
David Metcalf, the US Attorney for the Eastern District of Pennsylvania, said: “Russian military intelligence once again hijacked Americans’ hardware to commandeer critical data. In the face of continued aggression by our nation-state adversaries, the US government will respond just as aggressively.”
The US effort, dubbed “Operation Masquerade,” was led by FBI Boston after authorization by a court.
As described in court documents, unsealed in the Eastern District of Pennsylvania, the FBI developed a series of commands to send to US-based routers compromised by APT28.
These commands were designed to collect evidence regarding the threat group’s activity, reset DNS settings – remove DNS resolvers installed by APT28 and force routers to obtain legitimate DNS resolvers from their internet service providers (ISPs) – and to prevent the hackers from exploiting the original means of unauthorized access.
After testing the operation “extensively” on firmware and hardware for affected TP-Link routers, the DoJ confirmed it did not impact the routers’ normal functionality or collect the legitimate users’ content information.
“The court-authorized steps to remediate compromised routers can be reversed by legitimate users at any time through factory resets with hardware reset buttons,” said the DoJ statement.
“Legitimate users can also reverse changes by logging into web management pages and restoring desired settings (e.g., factory default settings).”
The FBI is now working with ISPs to provide notice of the operation to users of SOHO routers covered by the court’s authorization.
Operation Masquerade involved several agencies, including the Philadelphia Field Offices and Cyber Division, the US Attorney’s Office for the Eastern District of Pennsylvania and the National Security Division’s National Security Cyber.
It also benefited from the collaboration of several private-sector partners, including Lumen’s Black Lotus Labs, Microsoft Threat Intelligence and the MIT Lincoln Laboratory.
Brett Leatherman, Assistant Director of FBI’s Cyber Division, commented: “GRU actors compromised routers in the US and around the world, hijacking them to conduct espionage. Given the scale of this threat, sounding the alarm wasn't enough.”
John A. Eisenberg, Assistant Attorney General for National Security, called the Russian campaign “a serious and persistent threat” and said his department will “continue to use every tool at our disposal to detect such intrusions and expel hostile foreign actors from our nation’s networks.”
The DoJ urged users who believe they have a compromised router to contact their local FBI field office or file a report with the FBI’s Internet Crime Complaint Center (IC3).
They are also advised to take the following steps:
“We urge all router owners to take the remediation steps outlined today, because defending our networks requires all of us,” said FBI’s Leatherman.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。