Loading story…
The U.S. Department of Justice disrupted a botnet of thousands of compromised Ubiquiti EdgeRouters controlled by Russia’s GRU-linked APT28, also known as Fancy Bear, in the court-authorized Operation Dying Ember. The operation took place in January 2024 and was announced on February 15. APT28 commandeered routers previously infected by Moobot, a Mirai-derived criminal botnet, to support cyber operations worldwide as early as 2022. A subsequent joint advisory detailed credential harvesting, NTLM relay attacks, traffic proxying, spear-phishing infrastructure, stolen-data exfiltration, and command-and-control for MASEPIE malware. APT28 also exploited the Microsoft Outlook vulnerability CVE-2023-23397 to obtain NTLMv2 authentication material, including after a patch became available.
The disruption did not eliminate the need for owners to remediate compromised routers. Authorities recommended hardware factory resets, firmware upgrades, replacement of default credentials, and WAN-side firewall restrictions, alongside Outlook patching and protections against NTLM relay. Forescout separately recorded 4,815 login attempts using the default Ubiquiti username “ubnt” over approximately one year, underscoring persistent credential-based attacks on exposed devices. Security teams should inventory internet-facing routers, verify remediation, harden administrative access, and segment networks to reduce the risk of criminal IoT infrastructure being repurposed for state-sponsored operations.
See which actors are running it and whether you're in range.
8 events from the most recent confirmed update back to the earliest known activity.
On February 27, 2024, the FBI, NSA, U.S. Cyber Command, and international partners published advisory JCSA-20240227-001, attributing the operations to Russia's GRU 85th Main Special Service Center. The advisory disclosed malware indicators and router exploitation techniques, and urged owners to factory-reset compromised devices, upgrade firmware, replace default credentials, and restrict remote management.
On February 15, 2024, the Justice Department announced Operation Dying Ember, revealing the January disruption of the router botnet controlled by Russia's APT28. APT28 had leveraged existing Moobot infections to install its own malicious files and support spear-phishing, credential harvesting, and stolen-data exfiltration.
During the first half of February 2024, Forescout observed 77 Moobot samples distributed through several IP addresses and nguyennghi[.]info. The samples contacted more than 480 IP addresses and several potentially malicious domains.
The U.S. Department of Justice conducted a disruption of the APT28-controlled botnet in January 2024. The botnet comprised thousands of hijacked Ubiquiti Edge OS routers repurposed as a global espionage platform.
APT28 wrote MASEPIE in December 2023, a Python backdoor capable of executing arbitrary commands on victim systems. The actor repeatedly used compromised EdgeRouters as command-and-control infrastructure for the malware.
In early 2023, APT28 developed and uploaded custom Python scripts to compromised Ubiquiti routers to collect and validate webmail credentials stolen through cross-site scripting and browser-in-the-browser spear-phishing campaigns. The scripts used an external CAPTCHA-solving service to automate login attempts.
The FBI found that APT28 exploited CVE-2023-23397 as early as 2022 to collect NTLMv2 authentication material from targeted Outlook accounts. The actor continued exploiting the vulnerability after Microsoft released a patch.
As early as 2022, APT28 used compromised Ubiquiti EdgeRouters against governments, militaries, and organizations across multiple sectors and countries. The actor accessed routers previously infected by the criminal Moobot botnet and repurposed them for credential harvesting, traffic proxying, and spear-phishing infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
forescout.com
Open sourcejustice.gov
Open sourceic3.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The FBI and Justice Department said they disrupted multiple Russian GRU operations that hijacked small office/home office routers to conceal espionage activity, proxy malicious traffic, and steal credentials. In one court-authorized action, **Operation Dying Ember**, agents remotely accessed hundreds of compromised **Ubiquiti EdgeOS** routers infected with **Moobot**, deleted malware and related files, and temporarily changed firewall rules to cut off **APT28**—also tracked as **Fancy Bear**, **Sednit**, and **Forest Blizzard**—without disrupting normal device use. Officials said the botnet had originally been built by cybercriminals abusing internet-exposed routers with default administrator passwords before being repurposed by Russia’s **GRU Unit 26165**. U.S. authorities later said a related GRU campaign also compromised SOHO routers, including **TP-Link** devices, to alter **DNS** settings and conduct adversary-in-the-middle attacks against **TLS** sessions, including Outlook traffic, in operations affecting government, IT, telecommunications, and energy targets. In **Operation Masquerade**, the FBI sent commands to infected routers to collect forensic data and reset malicious DNS configurations, removing Russian access from the devices. Microsoft and U.S. agencies linked the activity to APT28 and warned that router compromises can enable traffic redirection, credential theft, malware delivery, and denial-of-service attacks, urging organizations to patch firmware, verify DNS settings, disable unnecessary remote management, and replace end-of-life hardware.
Jun 29, 2026
Authorities and private-sector partners disrupted an **APT28** campaign known as **FrostArmada** that hijacked DNS traffic on compromised SOHO routers to steal Microsoft 365 credentials and OAuth tokens. Investigators said the operation abused **MikroTik**, **TP-Link**, some **Nethesis**, and older **Fortinet** devices, redirecting authentication traffic through attacker-controlled VPS infrastructure to perform adversary-in-the-middle interception. Microsoft and Lumen Black Lotus Labs traced the activity, identified victims, and supported action by the **FBI**, the **U.S. Department of Justice**, and Polish authorities to take malicious infrastructure offline. At its peak in December 2025, the campaign had infected about **18,000 devices in 120 countries** and affected government agencies, law enforcement, IT and hosting providers, and organizations running their own servers. The disruption comes amid broader warnings that Russia-linked **Fancy Bear**—also tracked as **APT28**, **Forest Blizzard**, and **Pawn Storm**—continues global cyber-espionage and disruptive operations. Recent reporting tied the group not only to router-based DNS hijacking, including abuse of TP-Link devices and exploitation of **`CVE-2023-50224`**, but also to **NTLMv2** hash relay attacks leveraging Outlook flaw **`CVE-2023-23397`** and malware activity targeting Ukraine’s defense supply chain and allied countries. Security guidance from Microsoft, the UK NCSC, researchers, and government agencies urged organizations to harden routers, patch internet-facing systems, enable MFA, reduce external exposure, remove end-of-life equipment, and adopt certificate pinning and zero-trust controls to limit credential theft and follow-on compromise.
Jun 29, 2026
The FBI disrupted an **APT28** operation that compromised internet-connected routers to enable **DNS hijacking**, according to reporting citing U.S. and UK government findings. The campaign abused vulnerable edge devices to alter DNS settings and redirect traffic, giving the Russian state-linked group a way to intercept victim communications, harvest credentials, and support follow-on espionage activity. The activity was significant enough to prompt public warnings from the FBI and the UK **NCSC**, which described router exploitation as a key enabler for the hijacking operations. Government guidance tied the operation to exploitation of routers exposed to the internet and urged organizations to harden perimeter infrastructure by patching devices, restricting remote administration, rotating credentials, and reviewing DNS configurations for unauthorized changes. The disclosures underscore how Russian espionage actors continue to rely on stealthy network-level tradecraft—using compromised infrastructure rather than malware alone—to persist in victim environments and covertly redirect or monitor traffic.
Jun 29, 2026