US disrupts Russian military-run DNS hijacking network, Justice Department says

• Companies

• Lumen Technologies Inc

  Follow

• Microsoft Corp

  Follow

WASHINGTON, April 7 (Reuters) - The U.S. Justice Department said on Tuesday it carried out a court-authorized disruption of a DNS hijacking network controlled by a Russian military intelligence unit.

The ​network was operated by Russia’s Main Intelligence Directorate of the General Staff (GRU) Military ‌Unit 26165, the department said in a statement.

The Reuters Iran Briefing newsletter keeps you informed with the latest developments and analysis of the Iran war. Sign up here.

It added the GRU used routers to facilitate hijacking operations against worldwide targets, including individuals in military, government and critical infrastructure sectors.

The efforts targeted thousands of routers worldwide ​and enabled the Russian hackers to filter traffic to identify specific targets, according ​to the Justice Department.

Once targets were identified, targets’ unencrypted network traffic was ⁠captured, providing the hackers with passwords, authentication tokens, emails and other sensitive information, it added.

“GRU ​actors compromised routers in the U.S. and around the world, hijacking them to conduct espionage. ​Given the scale of this threat, sounding the alarm wasn’t enough,” said Brett Leatherman, the assistant director of the FBI’s Cyber Division.

The FBI identified compromised routers in the U.S., collected evidence of Russian targeting, cut off ​GRU access, and reset them to normal functionality, the Justice Department said in its ​statement.

In a post on social media platform X, Leatherman said the takedown effort, dubbed “Operation Masquerade,” included partners in ‌15 ⁠countries.

Without action, “the GRU would have continued intercepting encrypted traffic and stealing sensitive information,” he said, adding, “Russia’s cyber program is an enduring threat.”

Officials in Germany and Britain, opens new tab also issued advisories about the hacking campaign on Tuesday.

The Russian Embassy in Washington did not respond to requests for comment.

The operation is ​the latest example of ​intelligence collection carried ⁠out by the Russian military intelligence hacking unit, Microsoft (MSFT.O), opens new tab said in a blog, opens new tab post released ahead of the Justice Department’s statement. Microsoft identified more ​than 200 organizations and 5,000 consumer devices impacted by the hacking ​operation, the company ⁠said.

Lumen Technologies’ (LUMN.N), opens new tab Black Lotus Labs, which identified part of the botnet infrastructure last year, said ina blog post, opens new tab that the operations primarily targeted government agencies, including ministries of foreign affairs, law ⁠enforcement and ​third-party email providers.

The researchers did not identify specific targets, ​but said their analysis revealed targets in the U.S., Europe, Afghanistan, North Africa, Central America and Southeast Asia.

Reporting by ​Jasper Ward in Washington and AJ Vicens in Detroit; Editing by Daphne Psaledakis and Jamie Freed

Our Standards: The Thomson Reuters Trust Principles., opens new tab

• Suggested Topics:

• Cybersecurity

• Data Privacy

• X

• Facebook

• Linkedin

• Email

• Link

Purchase Licensing Rights