FBI, NSA, and international partners warn of APT28's use of compromised EdgeRouters for cyber operations.

Cyber & Information WarfareCyber AttacksHacking, malware, ransomware

Aggressor

Summary

This Joint Cybersecurity Advisory warns of Russian state-sponsored cyber actors, specifically the GRU's APT28, using compromised Ubiquiti EdgeRouters to facilitate a variety of malicious cyber operations globally.

Classification

Confidence: High

The information outlines aggressive cyber actions carried out by acknowledged Russian state-sponsored actors, raising concerns of ongoing threats.

Source URL

https://media.defense.gov/2024/Feb/27/2003400753/-1/-1/0/CSA-Russian-Actors-Use-Routers-Facilitate-Cyber_Operations.PDF

Open source

Provenance

Publisher: extension
Submitted: Jun 11, 2026, 17:25 UTC
Last updated: Nov 4, 2026, 08:35 UTC
Event time: Feb 27, 2024, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "be0d9705-c750-473f-b18a-627cc3c9ec6f",
  "url": "https://media.defense.gov/2024/Feb/27/2003400753/-1/-1/0/CSA-Russian-Actors-Use-Routers-Facilitate-Cyber_Operations.PDF",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Hacking, malware, ransomware",
  "country": "United States of America",
  "source_reliability": "B",
  "info_credibility": "3",
  "tags": [
    "APT28",
    "EdgeRouters",
    "offensive cyber operations",
    "Russian Cyber Actors"
  ],
  "nodes": [],
  "countries": [],
  "where_text": "Cyberspace",
  "headline": null,
  "description": "This Joint Cybersecurity Advisory warns of Russian state-sponsored cyber actors, specifically the GRU's APT28, using compromised Ubiquiti EdgeRouters to facilitate a variety of malicious cyber operations globally.",
  "summary_short": "FBI, NSA, and international partners warn of APT28's use of compromised EdgeRouters for cyber operations.",
  "summary_extended": null,
  "actor_primary": "APT28",
  "target_primary": null,
  "location_text": "United States of America",
  "location_region": null,
  "location_coordinates_lat": 37.09024,
  "location_coordinates_lon": -95.712891,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The information outlines aggressive cyber actions carried out by acknowledged Russian state-sponsored actors, raising concerns of ongoing threats.",
  "event_time_utc": "2024-02-27T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "unknown",
  "created_at": "2026-06-11T17:25:00.261Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "regional",
  "time_precision_band": "unknown",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "independent_sources"
}

Public assessmentReliability: StrongSeverity: SignificantAttribution: HighIndependence confirmedTime: UnknownLocation: Regional

Source reliability

Info credibility

Event time

Feb 27, 2024, 00:00 UTC

Event time confidence

unknown

Location

United States of America

Primary actor

APT28

Country

United States of America

Tags

APT28, EdgeRouters, offensive cyber operations, Russian Cyber Actors

Loading signal...

{ "id": "be0d9705-c750-473f-b18a-627cc3c9ec6f", "url": "https://media.defense.gov/2024/Feb/27/2003400753/-1/-1/0/CSA-Russian-Actors-Use-Routers-Facilitate-Cyber_Operations.PDF", "source": "extension", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Cyber Attacks", "incident_type": "Hacking, malware, ransomware", "country": "United States of America", "source_reliability": "B", "info_credibility": "3", "tags": [ "APT28", "EdgeRouters", "offensive cyber operations", "Russian Cyber Actors" ], "nodes": [], "countries": [], "where_text": "Cyberspace", "headline": null, "description": "This Joint Cybersecurity Advisory warns of Russian state-sponsored cyber actors, specifically the GRU's APT28, using compromised Ubiquiti EdgeRouters to facilitate a variety of malicious cyber operations globally.", "summary_short": "FBI, NSA, and international partners warn of APT28's use of compromised EdgeRouters for cyber operations.", "summary_extended": null, "actor_primary": "APT28", "target_primary": null, "location_text": "United States of America", "location_region": null, "location_coordinates_lat": 37.09024, "location_coordinates_lon": -95.712891, "location_precision": "Regional", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The information outlines aggressive cyber actions carried out by acknowledged Russian state-sponsored actors, raising concerns of ongoing threats.", "event_time_utc": "2024-02-27T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "unknown", "created_at": "2026-06-11T17:25:00.261Z", "updated_at": "2026-11-04T08:35:32.139Z", "reliability_band": "strong", "location_precision_band": "regional", "time_precision_band": "unknown", "severity_band": "significant", "attribution_confidence_band": "high", "attribution_basis": "independent_sources" }