U.S. Government Disrupts Russia-Linked Botnet Engaged in Cyber Espionage

*Executive summary:* The U.S. Department of Justice and FBI disrupted a MooBot/Mirai-based botnet used by the Russia-linked APT28 (GRU) to compromise Ubiquiti SOHO routers across the United States, turning them into proxies to mask actor locations, harvest credentials and NTLMv2 hashes, host spear-phishing pages, and persist via SSH implants; court-authorized actions (operation "Dying Ember") copied and removed stolen data and altered firewall rules to block the attackers.