US Thwarts DNS Hijacking Network Controlled by Russian APT28 Hackers

*Executive summary:* APT28 (attributed to Russia's GRU, Unit 26165) conducted a large DNS-hijacking campaign by compromising SOHO routers—notably TP-Link devices—to redirect traffic through attacker-controlled DNS servers and harvest credentials; US and UK authorities detailed the campaign and the DOJ/FBI executed a court-authorized Operation Masquerade to neutralize the US portion of the infrastructure, reset affected routers' DNS settings, coordinate with ISPs, and publish remediation guidance for users.