U.S. Disrupts Russian Military Hackers' Global DNS Hijacking Network

The U.S. Justice Department has successfully executed a court-authorized operation to dismantle a DNS hijacking network tied to Russian military intelligence. The network was run by GRU Military Unit 26165, a cyber unit operating under Russia's Main Intelligence Directorate of the General Staff.

According to federal authorities, the GRU exploited compromised routers across the globe to carry out large-scale espionage campaigns. Thousands of devices were infiltrated, allowing Russian operatives to intercept unencrypted network traffic and harvest sensitive data — including passwords, authentication tokens, and confidential emails — from victims in military, government, and critical infrastructure sectors worldwide.

The FBI played a central role in the takedown, identifying affected routers on U.S. soil, gathering key intelligence on Russian targeting activity, and restoring compromised devices to their original settings. Brett Leatherman, Assistant Director of the FBI's Cyber Division, confirmed that without intervention, the GRU would have continued siphoning sensitive information undetected. Dubbed "Operation Masquerade," the coordinated effort brought together cybersecurity partners from 15 countries, underscoring the global scope of both the threat and the response.

Microsoft, which released findings ahead of the Justice Department's announcement, reported that the hacking campaign affected more than 200 organizations and approximately 5,000 consumer devices. Cybersecurity firm Lumen Technologies' Black Lotus Labs, which had previously flagged part of the botnet infrastructure, noted that primary targets included government ministries, law enforcement bodies, and third-party email providers across the U.S., Europe, Afghanistan, North Africa, Central America, and Southeast Asia.

Germany and the United Kingdom also issued cybersecurity advisories on the same day, reinforcing the widespread concern over Russian state-sponsored cyber threats. The Russian Embassy in Washington offered no response to requests for comment. Leatherman emphasized that Russia's cyber program remains a persistent and evolving danger to global digital security.