{
  "id": "57b0268b-26c5-45b5-b39b-0e37db5e430a",
  "url": "https://rferl.org/a/russia-hacker-routers-gru-military-intelligence-forest-blizzard/33728527.html",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Hacking, malware, ransomware",
  "country": "Unknown",
  "source_reliability": "B",
  "info_credibility": "3",
  "tags": [
    "GRU",
    "APT28",
    "Forest Blizzard",
    "offensive cyber operations",
    "dns hijacking",
    "router hack",
    "Russian military intelligence",
    "US FBI",
    "Microsoft",
    "Lumen",
    "British cyber authorities"
  ],
  "nodes": [],
  "countries": [],
  "where_text": "Cyberspace",
  "headline": null,
  "description": "Russian military intelligence-linked hackers, identified as the group Forest Blizzard (APT28) tied to GRU's Military Unit 26165, carried out a widespread cyber operation compromising thousands of internet routers worldwide starting in May 2025, primarily targeting government agencies. They modified DNS settings on more than 5,000 consumer devices at 200 organizations beginning in August 2025, allowing them to hijack communications passing through these routers. At peak activity in December 2025, over 18,000 devices across at least 120 countries were hooked into the hackers' infrastructure for espionage purposes. This operation enabled persistent, passive visibility of e-mail traffic, website log-ons, and passwords over months. The campaign was linked by British, Dutch, and US authorities to previous GRU cyber intrusions, including interference in the 2016 US elections, hacking of Germany’s parliament in 2015, and an attempted hack of the OPCW in 2018. The FBI's assistant director Brett Leatherman stated the global scale warranted a strong alarm warning, and law enforcement agencies worldwide issued advisories urging people to check their routers’ security settings. British cyber authorities pointed to this group’s long history of espionage targeting government and international bodies. Microsoft described the DNS hijacking technique used as a method enabling large-scale persistent reconnaissance by nation-state actors.",
  "summary_short": "Russian military intelligence hackers compromised thousands of internet routers worldwide from mid-2025, hijacking DNS settings to conduct espionage and monitor communications.",
  "summary_extended": "In a large-scale cyber operation, hackers connected to the Russian military intelligence agency, GRU, infiltrated thousands of consumer routers globally, including in the US, starting from May until at least December 2025. They altered the Domain Name System (DNS) settings on over 5,000 devices at 200 organizations from August 2025 and at peak hooked more than 18,000 devices in over 120 countries to their infrastructure. The hackers primarily targeted government agencies such as foreign ministries, law enforcement, and third-party email providers. This hacking campaign was linked to Advanced Persistent Threat 28 (APT28), also known as Forest Blizzard, attributed to GRU's Military Unit 26165. This group was previously implicated in high-profile cyberattacks including the 2016 US election interference and hacks on the German parliament and OPCW. The FBI's assistant director Brett Leatherman highlighted the espionage scale, underlining global concern. The attack enabled persistent passive monitoring of email traffic and credentials for months, causing international law enforcement agencies to issue simultaneous warnings to users to secure their routers.",
  "actor_primary": "Forest Blizzard (APT28)",
  "target_primary": null,
  "location_text": "Cyberspace",
  "location_region": "Cyberspace",
  "location_coordinates_lat": null,
  "location_coordinates_lon": null,
  "location_precision": "Unknown",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article documents a discrete cyber espionage operation by Russian military intelligence hackers targeting routers worldwide, confirmed by multiple credible sources including the FBI and Microsoft. This is a clear aggressor action with defined perpetrators and explicit malicious intent. There is no direct mention of defense preparations in this event.",
  "event_time_utc": "2026-04-09T14:56:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "exact",
  "created_at": "2026-04-09T18:31:00.043Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "unknown",
  "time_precision_band": "exact",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "independent_sources"
}

{
  "id": "57b0268b-26c5-45b5-b39b-0e37db5e430a",
  "url": "https://rferl.org/a/russia-hacker-routers-gru-military-intelligence-forest-blizzard/33728527.html",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Hacking, malware, ransomware",
  "country": "Unknown",
  "source_reliability": "B",
  "info_credibility": "3",
  "tags": [
    "GRU",
    "APT28",
    "Forest Blizzard",
    "offensive cyber operations",
    "dns hijacking",
    "router hack",
    "Russian military intelligence",
    "US FBI",
    "Microsoft",
    "Lumen",
    "British cyber authorities"
  ],
  "nodes": [],
  "countries": [],
  "where_text": "Cyberspace",
  "headline": null,
  "description": "Russian military intelligence-linked hackers, identified as the group Forest Blizzard (APT28) tied to GRU's Military Unit 26165, carried out a widespread cyber operation compromising thousands of internet routers worldwide starting in May 2025, primarily targeting government agencies. They modified DNS settings on more than 5,000 consumer devices at 200 organizations beginning in August 2025, allowing them to hijack communications passing through these routers. At peak activity in December 2025, over 18,000 devices across at least 120 countries were hooked into the hackers' infrastructure for espionage purposes. This operation enabled persistent, passive visibility of e-mail traffic, website log-ons, and passwords over months. The campaign was linked by British, Dutch, and US authorities to previous GRU cyber intrusions, including interference in the 2016 US elections, hacking of Germany’s parliament in 2015, and an attempted hack of the OPCW in 2018. The FBI's assistant director Brett Leatherman stated the global scale warranted a strong alarm warning, and law enforcement agencies worldwide issued advisories urging people to check their routers’ security settings. British cyber authorities pointed to this group’s long history of espionage targeting government and international bodies. Microsoft described the DNS hijacking technique used as a method enabling large-scale persistent reconnaissance by nation-state actors.",
  "summary_short": "Russian military intelligence hackers compromised thousands of internet routers worldwide from mid-2025, hijacking DNS settings to conduct espionage and monitor communications.",
  "summary_extended": "In a large-scale cyber operation, hackers connected to the Russian military intelligence agency, GRU, infiltrated thousands of consumer routers globally, including in the US, starting from May until at least December 2025. They altered the Domain Name System (DNS) settings on over 5,000 devices at 200 organizations from August 2025 and at peak hooked more than 18,000 devices in over 120 countries to their infrastructure. The hackers primarily targeted government agencies such as foreign ministries, law enforcement, and third-party email providers. This hacking campaign was linked to Advanced Persistent Threat 28 (APT28), also known as Forest Blizzard, attributed to GRU's Military Unit 26165. This group was previously implicated in high-profile cyberattacks including the 2016 US election interference and hacks on the German parliament and OPCW. The FBI's assistant director Brett Leatherman highlighted the espionage scale, underlining global concern. The attack enabled persistent passive monitoring of email traffic and credentials for months, causing international law enforcement agencies to issue simultaneous warnings to users to secure their routers.",
  "actor_primary": "Forest Blizzard (APT28)",
  "target_primary": null,
  "location_text": "Cyberspace",
  "location_region": "Cyberspace",
  "location_coordinates_lat": null,
  "location_coordinates_lon": null,
  "location_precision": "Unknown",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article documents a discrete cyber espionage operation by Russian military intelligence hackers targeting routers worldwide, confirmed by multiple credible sources including the FBI and Microsoft. This is a clear aggressor action with defined perpetrators and explicit malicious intent. There is no direct mention of defense preparations in this event.",
  "event_time_utc": "2026-04-09T14:56:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "exact",
  "created_at": "2026-04-09T18:31:00.043Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "unknown",
  "time_precision_band": "exact",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "independent_sources"
}