GRU

The FBI and Justice Department warned that Russian hackers linked to the GRU exploited vulnerabilities in outdated SOHO routers to conduct espionage by altering DNS settings and intercepting traffic. The hackers redirected internet requests through their servers to steal sensitive data, and authorities disrupted the U.S. portion of the network in April.

The article discusses Russia's historical use of 'active measures' to disrupt democracies, highlighting recent operations in Europe targeting ethnic minorities through defacement and divisive tactics. It notes the evolution of these strategies with AI and cognitive warfare, emphasizing the role of Russian intelligence agencies like the SVR, GRU, and FSB in undermining Western political systems.

The article draws parallels between current European hybrid threats and post-9/11 terrorism, urging adaptation of counterterrorism cooperation models. It highlights Russia and Iran's use of proxies and digital platforms to recruit individuals for sabotage and assassination plots, which align with the FBI's definition of international terrorism. The U.S. counterterrorism strategy acknowledges collaboration with European partners to address these covert state actions.

Andrei Kozlov, a former cybersecurity center head at Rostec, was appointed as an aide to Security Council Secretary Sergei Shoigu. He has alleged ties to Russia's GRU military intelligence agency.

The Russian military, through the APT28 group linked to the GRU, has hacked 18,000 to 40,000 consumer routers in 120 countries. These routers were used to spy on government agencies and alter DNS settings for Microsoft's 365 service. Researchers from Lumen Technologies' Black Lotus Labs reported the breach.