The FBI coordinated with other foreign partners to disrupt the campaign led by Russian military intelligence.
The FBI announced Thursday that it successfully disrupted a Russian hacking campaign led by the GRU that infiltrated more than a thousand home and small business routers that were used to carry out cyber operations against countries around the world, including the United States.
The Justice Department said coordinated law enforcement actions with other foreign partners succeeded in expelling the GRU operators from the routers while blocking their ability to re-access them.
The department said it identified a specific malware that the GRU relied on to infiltrate routers — dubbed “Moobot” — which was installed on the routers and which the GRU used to turn them into a “global cyber-espionage platform.”
The Justice Department said Russian military intelligence used the compromised routers to commit a range of crimes that included “large-scale phishing” campaigns targeting “targets of intelligence interest to the Russian government, such as U.S. and foreign governments, military, security, and corporations.” Organizations.”
In a court-authorized operation last month, the Justice Department said it used malware to copy and delete malicious data from routers and give victims full control of their networks.
“The Department of Justice is accelerating our efforts to disrupt the Russian government’s cyber campaigns against the United States and our allies, including Ukraine,” Attorney General Merrick Garland said in a statement announcing the disruption campaign. “In this case, Russian intelligence services turned to criminal groups to help them target routers in homes and offices, but the Department of Justice stopped their scheme. We will continue to disrupt and dismantle malicious cyber tools used by the Russian government that put the security of the United States at risk.” “And our allies.”
FBI Director Christopher Wray first announced news of the disruption campaign, dubbed “Operation Dying Ember,” in his remarks at the Munich Security Conference on Thursday.
“Through these operations – and many others like them – we have set our sights on all the elements we know from experience that make criminal organizations work,” Wray said. “Because we don’t just want to hit them, we want to hit them everywhere it hurts, and put them in their place hard.”
The operation follows a similar effort announced by the FBI just two weeks ago, which resulted in Chinese government-sponsored hackers being removed from hundreds of home and small business routers that were allegedly used to target US critical infrastructure networks.
The FBI also issued a warning indicating that it is still working with internet providers to alert other potential victims whose servers have been affected.
