Fifteen-Nation Investigation Exposes GRU Unit 26165 Global Router Exploitation Campaign

A coalition of 15 nations including the U.S., UK, Ukraine, Poland, Germany, and Romania published findings of a GRU Unit 26165 (APT28/Fancy Bear) campaign that compromised vulnerable routers worldwide to steal passwords, authentication tokens, and encrypted data by redirecting internet traffic through DNS servers acting as intermediaries. Active since at least 2024, the operation targeted military personnel, state bodies, and defense contractors, with Romania reporting collection of military, governmental, and critical infrastructure intelligence. The campaign defeated SSL/TLS encryption protections, enabling interception of emails and credentials at scale.