Russian GRU and FSB SOHO Router Hijacking Campaigns

Operation Masquerade details a coordinated effort by the FBI and 15 international partner nations to dismantle a global DNS hijacking network operated by the Russian GRU (APT28). The threat actor primarily targeted TP-Link and Ubiquiti EdgeRouter devices, poisoning DNS configurations to redirect traffic through adversary-controlled infrastructure. This enabled highly targeted adversary-in-the-middle (AitM) attacks against services like Microsoft Outlook Web Access (OWA) to harvest sensitive credentials and emails.

Technically, the campaign leverages a mix of commodity vulnerabilities (CVE-2023-50224) and default credentials to gain initial access. A parallel campaign by FSB Center 16 focuses on SNMP scanning and exploiting legacy Cisco vulnerabilities (CVE-2018-0171, CVE-2008-4128) to exfiltrate device configurations. The overlap in TTPs between Russian actors and Chinese groups like Salt Typhoon indicates a strategic shift where state intelligence services treat consumer-grade networking equipment as a primary intelligence collection platform.

These operations represent a critical risk to remote workers and branch offices where SOHO infrastructure often lacks the rigorous patching and monitoring found in core data centers. The FBI's use of court-authorized remote remediation highlights the scale of the threat, but the persistent use of outdated firmware and default settings by end-users ensures these devices remain high-priority targets for persistence and traffic interception.