FBI Disrupts Russian Router Hijacking Operation Compromised Thousands of Users

On April 7, 2026 the DOJ and FBI announced “Operation Masquerade,” a court-authorized takedown that neutralized a large GRU-linked (APT28/Fancy Bear) campaign which exploited SOHO router vulnerabilities to redirect DNS traffic to attacker-controlled resolvers and conduct actor-in-the-middle espionage; the FBI remotely collected evidence, purged malicious DNS settings, restored ISP defaults and patched devices across 23 states with intelligence from Microsoft and Black Lotus Labs.