Skip to main content
Back to the takedown index

GRU DNS-hijacking router network disruption (APT28)

April 2026, State sponsored
Led by Federal Bureau of Investigation

Extended pass entry, last reviewed August 21, 2026

What was taken down?

US-based component of the router network neutralized; operation explicitly limited to infrastructure within US judicial reach.

See what happened

What happened to the people?

No individual outcomes are recorded against this entry.
Group accounted for: Not applicable

See people and accountability

Did it stay down?

Not established in the public record. No later activity is recorded against this entry.

See what happened afterward

DOJ/FBI national-security cyber investigators conducted a court-authorized technical operation neutralizing the US portion of a GRU Military Unit 26165 network of compromised SOHO routers used to redirect DNS traffic to GRU-controlled resolvers.

Date
April 2026
Target
GRU Military Unit 26165 SOHO router network, state sponsored botnet
Activity
State sponsored
Operational lead
FBI
Partners
DOJ[1]
Jurisdiction
Not established
Outcome
US-based component of the router network neutralized; operation explicitly limited to infrastructure within US judicial reach.
Status
Completed
Legal mechanism
Court-authorized technical operation (Rule 41-type warrant).
Group accounted for
Not applicable

No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved.

Group accounted for: Not applicable

State-sponsored operation; action was explicitly scoped to infrastructure within US jurisdiction rather than a personnel-capture effort.

See the organizations and roles behind this action

Not established in the public record. No later activity is recorded against this entry.

Numbered markers throughout this entry link to the source that supports the claim beside them.

Official sources

  1. [1]
    DOJ disrupts GRU Unit 26165 DNS-hijacking router network

    US DOJ, April 1, 2026, Source grade P1

    Establishes the court-authorized neutralization of the US-based portion of the GRU router network.

    No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

Coverage note. Added from deep-research aggregation pass. Not independently re-verified source-by-source to the same standard as the original 38-incident core; source_quality capped at S2/P2 pending a dedicated verification pass.