[Back to the takedown index](https://takedownindex.org/takedowns)

# GRU DNS-hijacking router network disruption (APT28)

April 2026, State sponsored
Led by [Federal Bureau of Investigation](https://takedownindex.org/organizations/federal-bureau-of-investigation)

Extended pass entry, last reviewed August 21, 2026

What was taken down?

US-based component of the router network neutralized; operation explicitly limited to infrastructure within US judicial reach.

[See what happened](#what-happened)

What happened to the people?

No individual outcomes are recorded against this entry.
Group accounted for: Not applicable

[See people and accountability](#people)

Did it stay down?

Not established in the public record. No later activity is recorded against this entry.

[See what happened afterward](#afterward)

## What happened

DOJ/FBI national-security cyber investigators conducted a court-authorized technical operation neutralizing the US portion of a GRU Military Unit 26165 network of compromised SOHO routers used to redirect DNS traffic to GRU-controlled resolvers.

**Date:** April 2026

**Target:** GRU Military Unit 26165 SOHO router network, state sponsored botnet

**Activity:** State sponsored

**Operational lead:** FBI

**Partners**

DOJ[[1]](#source-1)

- [United States Department of Justice](https://takedownindex.org/organizations/united-states-department-of-justice), prosecuting

**Jurisdiction:** Not established

**Outcome:** US-based component of the router network neutralized; operation explicitly limited to infrastructure within US judicial reach.

**Status:** Completed

**Legal mechanism:** Court-authorized technical operation (Rule 41-type warrant).

**Group accounted for:** Not applicable

## People and accountability

No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved.

Group accounted for: Not applicable

State-sponsored operation; action was explicitly scoped to infrastructure within US jurisdiction rather than a personnel-capture effort.

[See the organizations and roles behind this action](https://takedownindex.org/takedowns/gru-dns-hijacking-router-network-disruption-apt28/organizations)

## What happened afterward

Not established in the public record. No later activity is recorded against this entry.

## Sources

Numbered markers throughout this entry link to the source that supports the claim beside them.

### Official sources

1.
[DOJ disrupts GRU Unit 26165 DNS-hijacking router network](https://takedownindex.org/sources/us-doj-doj-disrupts-gru-unit-26165-dns-hijacking-router-network)

US DOJ, April 1, 2026, Source grade P1

Establishes the court-authorized neutralization of the US-based portion of the GRU router network.

No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

Coverage note. Added from deep-research aggregation pass. Not independently re-verified source-by-source to the same standard as the original 38-incident core; source\_quality capped at S2/P2 pending a dedicated verification pass.

Research context

## How this entry was checked

This entry came from a broader aggregation pass and has not been independently verified source by source. Its sources are graded no higher than P2 or S2, and most carry no address yet. Treat the figures as a research lead rather than a settled record.

Source review: Extended pass, not yet verified

Sources cited: 1

Research cutoff: August 20, 2026

Last reviewed August 21, 2026

See also

[About the Internet Takedown Index](https://takedownindex.org/about)

Related entries

- [Aisuru/KimWolf/JackSkid/Mossad IoT DDoS botnet disruption](https://takedownindex.org/takedowns/aisuru-kimwolf-jackskid-mossad-iot-ddos-botnet-disruption)
- [LeakBase seizure](https://takedownindex.org/takedowns/leakbase-seizure)
- [SocksEscort proxy network disruption](https://takedownindex.org/takedowns/socksescort-proxy-network-disruption)

Report updates or corrections

Help keep this record accurate.

[Submit feedback](https://takedownindex.org/about#corrections-and-updates)