Prosecutor release

# Justice Department Conducts Court-Authorized Disruption of DNS Hijacking Network Controlled by a Russian Military Intelligence Unit

US DOJ, April 7, 2026. Establishes the court-authorized neutralization of the US-based portion of the GRU router network..

**Source type:** Prosecutor release

**Published:** April 7, 2026

**Research grade:** P1

**Used in entries:** 6

## Bibliographic record

**Publisher:** US DOJ

**Published:** April 7, 2026

**Source type:** Prosecutor release

**Research grade:** Source grade P1

**Language:** English

**Official record:** Official publication

**Address:** [https://www.justice.gov/opa/pr/justice-department-conducts-court-authorized-disruption-dns-hijacking-network-controlled](https://www.justice.gov/opa/pr/justice-department-conducts-court-authorized-disruption-dns-hijacking-network-controlled)

**What it supports:** Establishes the court-authorized neutralization of the US-based portion of the GRU router network.

**Dataset id:** src\_doj\_gru\_router\_2026

How this source is used

Cited 6 times across 3 record types.

The role on each citation records what the source was relied on for. A primary source establishes the fact, a supporting source corroborates it, technical evidence describes the infrastructure, and a later outcome records what happened afterwards.

Sources were reviewed to a research cutoff of August 23, 2026. Addresses recorded after that date are not reflected here.

## Cited by

### Takedown records

1 citation

Cited on the takedown record itself.

-
[GRU DNS-hijacking router network disruption (APT28)](https://takedownindex.org/takedowns/gru-dns-hijacking-router-network-disruption-apt28)

State sponsored, Date not established

Primary source

### Organization roles

4 citations

Cited for an organization's recorded role in a takedown.

-
[Federal Bureau of Investigation](https://takedownindex.org/takedowns/gru-dns-hijacking-router-network-disruption-apt28)

Operational lead, GRU DNS-hijacking router network disruption (APT28)

Primary source
-
[United States Department of Justice](https://takedownindex.org/takedowns/gru-dns-hijacking-router-network-disruption-apt28)

Prosecuting, GRU DNS-hijacking router network disruption (APT28)

Primary source
-
[United States Attorney's Office for the Eastern District of Pennsylvania](https://takedownindex.org/takedowns/gru-dns-hijacking-router-network-disruption-apt28)

Prosecutor, GRU DNS-hijacking router network disruption (APT28)

Primary source
-
[Lumen Technologies Black Lotus Labs](https://takedownindex.org/takedowns/gru-dns-hijacking-router-network-disruption-apt28)

Technical partner, GRU DNS-hijacking router network disruption (APT28)

Primary source

### Infrastructure

1 citation

Cited for infrastructure recorded as acted on.

-
[Compromised TP-Link SOHO routers](https://takedownindex.org/takedowns/gru-dns-hijacking-router-network-disruption-apt28)

Item remediated, GRU DNS-hijacking router network disruption (APT28)

Primary source

[All sources](https://takedownindex.org/sources)