Skip to main content

Prosecutor release

Justice Department Conducts Court-Authorized Disruption of DNS Hijacking Network Controlled by a Russian Military Intelligence Unit

U.S. Attorney's Office, Eastern District of Pennsylvania (U.S. Department of Justice), April 7, 2026. That the U.S. Attorney's Office for the Eastern District of Pennsylvania was the charging/prosecuting office for the court-authorized disruption of a GRU Unit 26165 (APT28) DNS-hijacking network built on compromised TP-Link SOHO routers, with the FBI sending remediation commands to routers in the United States..

Source type
Prosecutor release
Published
April 7, 2026
Research grade
P1
Used in entries
0

Bibliographic record

Publisher
U.S. Attorney's Office, Eastern District of Pennsylvania (U.S. Department of Justice)
Published
April 7, 2026
Source type
Prosecutor release
Research grade
Source grade P1
Language
English
Official record
Official publication
What it supports
That the U.S. Attorney's Office for the Eastern District of Pennsylvania was the charging/prosecuting office for the court-authorized disruption of a GRU Unit 26165 (APT28) DNS-hijacking network built on compromised TP-Link SOHO routers, with the FBI sending remediation commands to routers in the United States.
Dataset id
src_usao_edpa_dns_hijacking_disruption

Research notes

  • Verified via the justice.gov press-release JSON API (https://www.justice.gov/api/v1/press_releases.json?title=DNS%20Hijacking); justice.gov blocks plain HTML fetching.
  • DOJ components listed on the release: FBI, FBI Cyber Division, National Security Division, USAO - Pennsylvania, Eastern.
  • The same release is also published by the DOJ Office of Public Affairs at https://www.justice.gov/opa/pr/justice-department-conducts-court-authorized-disruption-dns-hijacking-network-controlled
  • Announced as 'Operation Masquerade', led by FBI Boston.

How this source is used

Cited 0 times across 0 record types.

The role on each citation records what the source was relied on for. A primary source establishes the fact, a supporting source corroborates it, technical evidence describes the infrastructure, and a later outcome records what happened afterwards.

Sources were reviewed to a research cutoff of August 23, 2026. Addresses recorded after that date are not reflected here.

Cited by

No record in the index cites this source yet.