The Security Service of Ukraine (SBU), in conjunction with the FBI, Polish counterintelligence, and EU law enforcement agencies, has successfully executed a cyber operation that dismantled over 100 servers linked to the Russian military intelligence agency, GRU. This coordinated effort also restored control over hundreds of compromised routers within Ukraine.
According to the SBU, the GRU had been infiltrating both residential and office Wi-Fi routers belonging to Ukrainians and foreign nationals, exploiting devices that lacked modern security protocols. Once inside these vulnerable systems, the attackers redirected internet traffic through their own DNS servers, allowing them to intercept passwords, authentication tokens, and emails that are typically protected by cryptographic measures.
The intelligence gathered was intended for use in cyberattacks, information sabotage, and espionage activities. The GRU particularly targeted data from government officials, members of Ukraine’s Armed Forces, and entities within the defense industry.
This joint cyber operation has significantly weakened the intelligence capabilities of the Russian military intelligence. The SBU reported that the initiative not only blocked over 100 servers but also reclaimed hundreds of routers from GRU control, preventing potential destruction of equipment at the software level.
As part of ongoing efforts, the SBU and its Western allies are taking measures to hold accountable all individuals involved in these cyber crimes. The agency has also issued recommendations for router owners to enhance their security. Users are advised to check for security updates, change access passwords, disable remote management features, review settings, and remove any suspicious configurations. In cases where the router model is no longer supported by the manufacturer, users are encouraged to replace it with a more modern device.
Furthermore, the SBU has called upon telecommunications providers to assist clients in implementing these cybersecurity recommendations.
The SBU, alongside international partners, has disrupted a major Russian cyber operation by blocking numerous servers and reclaiming compromised routers. This initiative aims to enhance cybersecurity for Ukrainian users and hold accountable those responsible for cyber crimes.