Russian Stockpiled Telecom-Grade Routers DML

Russian military intelligence (GRU/APT28) has exploited thousands of consumer and small-office routers worldwide to conduct espionage, DNS hijacking, and credential theft, demonstrating a sophisticated global cyber operation. Overview of the CampaignRussian military-linked threat actors, primarily APT28 (also known as Forest Blizzard, Fancy Bear, or Strontium), have been systematically targeting telecom-grade and consumer routers, including TP-Link and MikroTik models, to build covert intelligence collection infrastructure. The campaign, active since at least 2025, involved 18,000 to 40,000 compromised routers across 120 countries, with a focus on devices in homes, small offices, and remote workplaces.

These routers were exploited to intercept network traffic, harvest credentials, and redirect DNS queries to Russian-controlled servers.

Methods and Techniques

The attackers leveraged outdated firmware, default SNMP credentials, and known vulnerabilities in routers such as TP-Link WR841N, Archer C5/C7, and MikroTik WDR series. Once compromised, the routers' DNS and DHCP settings were modified, causing all connected devices to unknowingly route traffic through Russian-controlled infrastructure. This allowed the GRU to: Intercept encrypted communications and OAuth tokens for cloud services like Microsoft 365.

Harvest passwords and authentication tokens without alerting users. Use compromised routers as proxies to reach higher-value targets, including government and law enforcement networks. The operation utilized both classic attack methods and advanced tools, including large language models like LAMEHUG, to automate and scale attacks while remaining difficult to detect.

Global Response and Mitigation

In April 2026, the FBI, UK National Cyber Security Centre, Microsoft, and Lumen Technologies coordinated Operation Masquerade, a court-authorized takedown of compromised routers in the U. S., effectively neutralizing part of the infrastructure. The campaign highlighted the risks posed by stockpiled or unpatched telecom-grade routers, prompting regulatory actions such as the FCC's inclusion of foreign-made consumer routers on a Covered List to prevent importation of devices deemed a national security risk.

Implications

This campaign underscores several critical points: Telecom-grade routers are high-value targets for state-sponsored espionage due to their central role in network traffic routing. Unpatched or end-of-life devices can be weaponized at scale, affecting both personal and organizational networks.

DN

S hijacking and credential theft can bypass traditional endpoint security, making detection challenging. Global coordination among intelligence and cybersecurity agencies is essential to mitigate such threats. In summary, Russian military intelligence has demonstrated the ability to stockpile and exploit telecom-grade routers for large-scale espionage, leveraging both technical vulnerabilities and sophisticated operational planning to compromise networks worldwide.