The U.S. Department of Justice and the FBI confirmed on April 7, 2026, that Russia’s military intelligence unit — GRU’s APT28, also known as Fancy Bear and Forest Blizzard — quietly compromised thousands of home and small-office routers across more than 23 U.S. states. The operation, named Operation Masquerade, involved redirecting every website request that passed through those devices to GRU-controlled servers, where credentials for services like Microsoft Outlook were intercepted before the traffic reached its real destination. This piece covers how the attack worked, which routers were targeted, and the five steps the FBI says every router owner should take.
The UK National Cyber Security Centre identified the following TP-Link models. All have reached End-of-Life status. Scroll to view the full list. The campaign’s focus on harvesting Microsoft 365 credentials is part of a broader trend in AI-era corporate credential attacks — context covered in Giganectar’s piece on enterprise AI platform security spending.
TP-Link confirmed these models are outside its standard maintenance lifecycle. Security patches for select legacy models are listed on the TP-Link security advisory page. The company recommends upgrading to a supported device where possible.
The FBI’s IC3 advisory (PSA260407) and the NSA recommend the following steps for all SOHO router owners. Click each item to mark it done.
The DOJ, FBI, UK NCSC, NSA, and 15 partner nations have all been covered above, along with the five steps recommended for router owners. The FBI’s IC3 advisory and TP-Link’s security advisory page remain the primary references for checking whether your device is affected and for guidance on remediation. Operation Masquerade was also discussed in the context of the broader US-China tech decoupling debate, as the FCC’s router import ban was issued weeks before the advisory. Related coverage on state-level cyber threats to networks is available in Giganectar’s reporting on AI infrastructure security and device-level security requirements. The social conversation around Operation Masquerade has continued across platforms since the April 7 announcement. Additional background on network security at the carrier level was covered in Giganectar’s piece on T-Mobile’s 5G network architecture.
