Eighteen thousand TP-Link routers. That's the scale of APT28's invisible empire — until the FBI flipped the switch. Operation Masquerade didn't just disrupt; it rewrote the rules of cyber defense.
Exactly two weeks before Microsoft patched it, APT28 had servers primed for CVE-2026-21509. This isn't random phishing—it's a precision strike on Ukraine's war machine and its allies.
Your router. That dusty box in the corner. Russia's Fancy Bear just turned thousands into propaganda machines. NCSC's dropping the alarm now.
Your coffee-maker router just got a lot less cozy. Russian spies used 18,000 of them to snag your Microsoft logins, and the feds only now slammed the door.
Routers. Those dusty boxes in your closet? Russia's GRU just got busted turning thousands into spy cams. FBI pulled the plug— but the real hack? We're all still wide open.
Imagine your trusty home router, that unassuming box humming in the corner, secretly funneling your data to Moscow. The US just shut that nightmare down—Operation Masquerade style.
Imagine your dusty home router silently funneling your login credentials to Moscow. That's APT28's FrostArmada in action—18,000 devices compromised across 120 countries.
Imagine your trusty router, that unassuming box in the corner, quietly handing your login details to GRU spies. Russia's APT28 just turned SOHO devices into credential vacuums, and the UK's NCSC is sounding the alarm.
Your router— that unassuming box humming in the corner— just got weaponized by Russian spies. Authorities smashed the plot mid-theft, but the scars linger across 120 countries.
Over 18,000 routers — mostly dusty old Mikrotik and TP-Link models — got flipped by Russian military hackers last year. They didn't drop malware; just tweaked DNS to swipe Microsoft auth tokens mid-session.