Russian GRU hacking group Fancy Bear hacks hundreds of Wi-Fi routers worldwide to spy on Western military and government targets

Cyber & Information WarfareCyber AttacksHacking, malware, ransomware

Aggressor

Summary

Russian GRU-linked hacking group Fancy Bear hacked hundreds of Wi-Fi routers worldwide since 2024 to spy on Western military, government, and critical infrastructure targets.

Russian cyber espionage group Fancy Bear, connected to Russia's GRU military intelligence, has conducted an extensive operation since at least 2024 to compromise Wi-Fi routers globally, including popular TP-Link models. Intelligence and law enforcement agencies from the United States, Canada, Ukraine, Germany, Italy, Poland, and others revealed this large-scale spying campaign that intercepted passwords, authentication tokens, emails, and other sensitive communications by circumventing encryption. The hackers strategically redirected traffic only to domains of interest such as Ukrainian government sites (.gov.ua) and military systems, enabling targeted intelligence gathering. The Ukrainian Security Service (SBU) highlighted special attention to data from Ukrainian state bodies, defense forces, and defense-industrial complexes. This operation supported cyberattacks, information sabotage, and espionage activities benefiting Russian military objectives.

Classification

Confidence: High

The article clearly describes a hostile Russian military intelligence cyber operation targeting Western and Ukrainian military, government, and critical infrastructure networks via router hacking by the GRU-affiliated group Fancy Bear. No defensive or response measures are described.

Source URL

https://politico.eu/article/russias-gru-hacked-hundreds-of-wi-fi-routers-world-wide

Open source

Provenance

Publisher: extension
Submitted: Apr 20, 2026, 13:45 UTC
Last updated: Nov 4, 2026, 08:35 UTC
Event time: Apr 7, 2026, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "85740fcd-783a-41f2-872a-37539a6dc505",
  "url": "https://politico.eu/article/russias-gru-hacked-hundreds-of-wi-fi-routers-world-wide",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Hacking, malware, ransomware",
  "country": "Unknown",
  "source_reliability": "B",
  "info_credibility": "3",
  "tags": [
    "Russian GRU",
    "Fancy Bear",
    "APT28",
    "Wi-Fi router hacking",
    "offensive cyber operations",
    "Military targets",
    "Government targets",
    "Critical infrastructure",
    "Ukraine",
    "Western intelligence",
    "TP-Link routers",
    "Information sabotage",
    "State-backed hacking"
  ],
  "nodes": [
    "Node 1: Borders"
  ],
  "countries": [],
  "where_text": "Cyberspace",
  "headline": "Russian GRU hacking group Fancy Bear hacks hundreds of Wi-Fi routers worldwide to spy on Western military and government targets",
  "description": "Since at least 2024, Russia's GRU-affiliated hacking group Fancy Bear (also known as APT28 and Forest Blizzard) has conducted a large-scale cyber espionage campaign by hacking ill-protected Wi-Fi routers globally. Intelligence agencies in the US, Canada, Ukraine, Germany, Italy, Poland and others exposed the operation, revealing the hackers collected passwords, authentication tokens, emails, and other sensitive data by bypassing encryption and security protocols. The group targeted military, government and critical infrastructure networks, focusing on Ukrainian state bodies, defense forces, and defense-industrial enterprises. Popular TP-Link routers were among those exploited, enabling the hackers to snoop on data from mobile devices and laptops. This breach facilitated cyberattacks, information sabotage, and intelligence gathering beneficial to Russian military intelligence.",
  "summary_short": "Russian GRU-linked hacking group Fancy Bear hacked hundreds of Wi-Fi routers worldwide since 2024 to spy on Western military, government, and critical infrastructure targets.",
  "summary_extended": "Russian cyber espionage group Fancy Bear, connected to Russia's GRU military intelligence, has conducted an extensive operation since at least 2024 to compromise Wi-Fi routers globally, including popular TP-Link models. Intelligence and law enforcement agencies from the United States, Canada, Ukraine, Germany, Italy, Poland, and others revealed this large-scale spying campaign that intercepted passwords, authentication tokens, emails, and other sensitive communications by circumventing encryption. The hackers strategically redirected traffic only to domains of interest such as Ukrainian government sites (.gov.ua) and military systems, enabling targeted intelligence gathering. The Ukrainian Security Service (SBU) highlighted special attention to data from Ukrainian state bodies, defense forces, and defense-industrial complexes. This operation supported cyberattacks, information sabotage, and espionage activities benefiting Russian military objectives.",
  "actor_primary": "Fancy Bear",
  "target_primary": null,
  "location_text": "Cyberspace",
  "location_region": "Cyberspace",
  "location_coordinates_lat": null,
  "location_coordinates_lon": null,
  "location_precision": "Unknown",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article clearly describes a hostile Russian military intelligence cyber operation targeting Western and Ukrainian military, government, and critical infrastructure networks via router hacking by the GRU-affiliated group Fancy Bear. No defensive or response measures are described.",
  "event_time_utc": "2026-04-07T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-04-20T13:45:00.037Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "unknown",
  "time_precision_band": "within_24h",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "independent_sources"
}

Public assessmentReliability: StrongSeverity: SignificantAttribution: HighIndependence confirmedTime: Same dayLocation: Unknown

Source reliability

Info credibility

Event time

Apr 7, 2026, 00:00 UTC

Event time confidence

pm24h

Location

Cyberspace

Region

Cyberspace

Primary actor

Fancy Bear

Country

Unknown

Tags

Russian GRU, Fancy Bear, APT28, Wi-Fi router hacking, offensive cyber operations, Military targets, Government targets, Critical infrastructure, Ukraine, Western intelligence, TP-Link routers, Information sabotage, State-backed hacking

Nodes

Node 1: Borders

Loading signal...

{ "id": "85740fcd-783a-41f2-872a-37539a6dc505", "url": "https://politico.eu/article/russias-gru-hacked-hundreds-of-wi-fi-routers-world-wide", "source": "extension", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Cyber Attacks", "incident_type": "Hacking, malware, ransomware", "country": "Unknown", "source_reliability": "B", "info_credibility": "3", "tags": [ "Russian GRU", "Fancy Bear", "APT28", "Wi-Fi router hacking", "offensive cyber operations", "Military targets", "Government targets", "Critical infrastructure", "Ukraine", "Western intelligence", "TP-Link routers", "Information sabotage", "State-backed hacking" ], "nodes": [ "Node 1: Borders" ], "countries": [], "where_text": "Cyberspace", "headline": "Russian GRU hacking group Fancy Bear hacks hundreds of Wi-Fi routers worldwide to spy on Western military and government targets", "description": "Since at least 2024, Russia's GRU-affiliated hacking group Fancy Bear (also known as APT28 and Forest Blizzard) has conducted a large-scale cyber espionage campaign by hacking ill-protected Wi-Fi routers globally. Intelligence agencies in the US, Canada, Ukraine, Germany, Italy, Poland and others exposed the operation, revealing the hackers collected passwords, authentication tokens, emails, and other sensitive data by bypassing encryption and security protocols. The group targeted military, government and critical infrastructure networks, focusing on Ukrainian state bodies, defense forces, and defense-industrial enterprises. Popular TP-Link routers were among those exploited, enabling the hackers to snoop on data from mobile devices and laptops. This breach facilitated cyberattacks, information sabotage, and intelligence gathering beneficial to Russian military intelligence.", "summary_short": "Russian GRU-linked hacking group Fancy Bear hacked hundreds of Wi-Fi routers worldwide since 2024 to spy on Western military, government, and critical infrastructure targets.", "summary_extended": "Russian cyber espionage group Fancy Bear, connected to Russia's GRU military intelligence, has conducted an extensive operation since at least 2024 to compromise Wi-Fi routers globally, including popular TP-Link models. Intelligence and law enforcement agencies from the United States, Canada, Ukraine, Germany, Italy, Poland, and others revealed this large-scale spying campaign that intercepted passwords, authentication tokens, emails, and other sensitive communications by circumventing encryption. The hackers strategically redirected traffic only to domains of interest such as Ukrainian government sites (.gov.ua) and military systems, enabling targeted intelligence gathering. The Ukrainian Security Service (SBU) highlighted special attention to data from Ukrainian state bodies, defense forces, and defense-industrial complexes. This operation supported cyberattacks, information sabotage, and espionage activities benefiting Russian military objectives.", "actor_primary": "Fancy Bear", "target_primary": null, "location_text": "Cyberspace", "location_region": "Cyberspace", "location_coordinates_lat": null, "location_coordinates_lon": null, "location_precision": "Unknown", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The article clearly describes a hostile Russian military intelligence cyber operation targeting Western and Ukrainian military, government, and critical infrastructure networks via router hacking by the GRU-affiliated group Fancy Bear. No defensive or response measures are described.", "event_time_utc": "2026-04-07T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "pm24h", "created_at": "2026-04-20T13:45:00.037Z", "updated_at": "2026-11-04T08:35:32.139Z", "reliability_band": "strong", "location_precision_band": "unknown", "time_precision_band": "within_24h", "severity_band": "significant", "attribution_confidence_band": "high", "attribution_basis": "independent_sources" }