OSINT
Photo
Nuno Felix
RT @FBILosAngeles: Russian General Staff Main Intelligence Directorate (GRU) cyber actors are exploiting vulnerable routers worldwide to intercept and steal sensitive military, government, and critical infrastructure information. The U.S. Department of Justice and the FBI recently disrupted a GRU network of compromised small-office home-office (SOHO) routers used to facilitate malicious DNS hijacking operations. The FBI and the following partners are releasing this announcement to warn the public and encourage network defenders and device owners to take actions to remediate and reduce the attack surface of similar edge devices: U.S. National Security Agency (NSA) and international partners from Canada, Czech Republic, Denmark, Estonia, Finland, Germany, Italy, Latvia, Lithuania, Norway, Poland, Portugal, Romania, Slovakia, and Ukraine.
Understanding the DNS Hijacking Operations
Since at least 2024, Russian GRU 85th Main Special Service Center (85th GTsSS) cyber actors — also known as APT28, Fancy Bear, and Forest Blizzard — have been collecting credentials and exploiting vulnerable routers worldwide, including compromising TP-Link routers using CVE-2023-50224. The GRU actors changed the devices' dynamic host configuration protocol (DHCP) / domain name system (DNS) settings to introduce actor-controlled DNS resolvers. Connected devices, including laptops and phones, inherit these modified settings. The actor-controlled infrastructure resolves and captures lookups for all domain names. The GRU provides fraudulent DNS answers for specific domains and services — including Microsoft Outlook Web Access — enabling adversary-in-the-middle (AitM) attacks against encrypted traffic if users navigate through a certificate error warning. These AitM attacks would allow the actors to see the traffic unencrypted.
The GRU has harvested passwords, authentication tokens, and sensitive information including emails and web browsing information normally protected by secure socket layer (SSL) and transport layer security (TLS) encryption. The GRU has indiscriminately compromised a wide pool of U.S. and global victims and then filtered down impacted users, especially targeting information related to military, government, and critical infrastructure.
Tips to Protect Yourself
The FBI and partners have released relevant guidance and technical indicators, including NCSC-UK cybersecurity advisory "APT28 exploit routers to enable DNS hijacking operations" on 7 April 2026 and CISA's Edge Device Security webpage.
Users of SOHO routers are encouraged to upgrade end-of-support devices, update to latest firmware versions, change default usernames and passwords, and disable remote management interfaces from the Internet. All users should carefully consider certificate warnings in web browsers and email clients.
Organizations that allow remote work should review relevant policies regarding how employees access sensitive data, such as using VPNs and hardened application configurations. Additionally, organizations may consider incentivizing employees to upgrade outdated personal devices involved in remote access.
Report It
If you suspect you have been targeted or compromised by a Russian GRU cyber intrusion, report the activity to your local FBI field office or file a complaint with the IC3. Be sure to provide details about your router, including device type and DHCP configurations.
Visit http://IC3.gov for additional details.
tweet
RT @FBILosAngeles: Russian General Staff Main Intelligence Directorate (GRU) cyber actors are exploiting vulnerable routers worldwide to intercept and steal sensitive military, government, and critical infrastructure information. The U.S. Department of Justice and the FBI recently disrupted a GRU network of compromised small-office home-office (SOHO) routers used to facilitate malicious DNS hijacking operations. The FBI and the following partners are releasing this announcement to warn the public and encourage network defenders and device owners to take actions to remediate and reduce the attack surface of similar edge devices: U.S. National Security Agency (NSA) and international partners from Canada, Czech Republic, Denmark, Estonia, Finland, Germany, Italy, Latvia, Lithuania, Norway, Poland, Portugal, Romania, Slovakia, and Ukraine.
Understanding the DNS Hijacking Operations
Since at least 2024, Russian GRU 85th Main Special Service Center (85th GTsSS) cyber actors — also known as APT28, Fancy Bear, and Forest Blizzard — have been collecting credentials and exploiting vulnerable routers worldwide, including compromising TP-Link routers using CVE-2023-50224. The GRU actors changed the devices' dynamic host configuration protocol (DHCP) / domain name system (DNS) settings to introduce actor-controlled DNS resolvers. Connected devices, including laptops and phones, inherit these modified settings. The actor-controlled infrastructure resolves and captures lookups for all domain names. The GRU provides fraudulent DNS answers for specific domains and services — including Microsoft Outlook Web Access — enabling adversary-in-the-middle (AitM) attacks against encrypted traffic if users navigate through a certificate error warning. These AitM attacks would allow the actors to see the traffic unencrypted.
The GRU has harvested passwords, authentication tokens, and sensitive information including emails and web browsing information normally protected by secure socket layer (SSL) and transport layer security (TLS) encryption. The GRU has indiscriminately compromised a wide pool of U.S. and global victims and then filtered down impacted users, especially targeting information related to military, government, and critical infrastructure.
Tips to Protect Yourself
The FBI and partners have released relevant guidance and technical indicators, including NCSC-UK cybersecurity advisory "APT28 exploit routers to enable DNS hijacking operations" on 7 April 2026 and CISA's Edge Device Security webpage.
Users of SOHO routers are encouraged to upgrade end-of-support devices, update to latest firmware versions, change default usernames and passwords, and disable remote management interfaces from the Internet. All users should carefully consider certificate warnings in web browsers and email clients.
Organizations that allow remote work should review relevant policies regarding how employees access sensitive data, such as using VPNs and hardened application configurations. Additionally, organizations may consider incentivizing employees to upgrade outdated personal devices involved in remote access.
Report It
If you suspect you have been targeted or compromised by a Russian GRU cyber intrusion, report the activity to your local FBI field office or file a complaint with the IC3. Be sure to provide details about your router, including device type and DHCP configurations.
Visit http://IC3.gov for additional details.
tweet
😱1
This media is not supported in your browser
VIEW IN TELEGRAM
WarTranslated
In Kazan, Republic of Tatarstan RF, sirens are wailing - locals are in shock that their "Special Military Operation" has reached so far. https://twitter.com/wartranslated/status/2042337307261304850/video/1
tweet
In Kazan, Republic of Tatarstan RF, sirens are wailing - locals are in shock that their "Special Military Operation" has reached so far. https://twitter.com/wartranslated/status/2042337307261304850/video/1
tweet
🤣1
Open Source Intel
The IDF says Hezbollah launched a limited salvo of rockets from Lebanon toward the Haifa area.
Some were intercepted, while others were permitted to land in open terrain.
No injuries have been reported.
tweet
The IDF says Hezbollah launched a limited salvo of rockets from Lebanon toward the Haifa area.
Some were intercepted, while others were permitted to land in open terrain.
No injuries have been reported.
NOW 🔴
Long range fire from Hezbollah towards Haifa, Israel https://twitter.com/Osint613/status/2042332335572394419/photo/1 tweet
The Spectator Index
Netanyahu says, 'There is no ceasefire in Lebanon. We are continuing to strike Hezbollah with force, and we will not stop until we restore your security'. https://twitter.com/spectatorindex/status/2042337509712203833/photo/1
tweet
Netanyahu says, 'There is no ceasefire in Lebanon. We are continuing to strike Hezbollah with force, and we will not stop until we restore your security'. https://twitter.com/spectatorindex/status/2042337509712203833/photo/1
tweet
Open Source Intel
Khamenei Jr:
“All must know that, by Almighty God’s will, we definitely won’t allow the criminal aggressors who attacked our country to go unpunished.” https://twitter.com/Osint613/status/2042337816558850317/photo/1
tweet
Khamenei Jr:
“All must know that, by Almighty God’s will, we definitely won’t allow the criminal aggressors who attacked our country to go unpunished.” https://twitter.com/Osint613/status/2042337816558850317/photo/1
tweet
WarMonitor
"Quick, take cover in the ballroom!"
tweet
"Quick, take cover in the ballroom!"
The White House is urging a federal appeals court to allow construction to continue on President Trump's $400 million ballroom, arguing it will help provide protection both for the president's family and the country as a whole. https://www.nbcnews.com/politics/white-house/trump-ballroom-national-security-necessity-vital-first-family-safety-rcna267482?cid=sm_npd_nn_tw_ma&taid=69d80540b797b600012722e4&utm_campaign=trueanthem&utm_medium=social&utm_source=twitter tweet
OSINTtechnical
New Trump post on Iran:
Primarily complains about Tucker Carlson, Megyn Kelly, Candace Owens, and Alex Jones. https://twitter.com/Osinttechnical/status/2042339907679523112/photo/1
tweet
New Trump post on Iran:
Primarily complains about Tucker Carlson, Megyn Kelly, Candace Owens, and Alex Jones. https://twitter.com/Osinttechnical/status/2042339907679523112/photo/1
tweet
WarMonitor
RT @MacFarlaneNews: Epstein survivor texts me to say “what a bizarre thing” for the First Lady to do
tweet
RT @MacFarlaneNews: Epstein survivor texts me to say “what a bizarre thing” for the First Lady to do
tweet
OSINT
Photo
Open Source Intel
President Trump: I know why Tucker Carlson, Megyn Kelly, Candace Owens, and Alex Jones have all been fighting me for years, especially by the fact that they think it is wonderful for Iran, the Number One State Sponsor of Terror, to have a Nuclear Weapon - Because they have one thing in common, Low IQs. They’re stupid people, they know it, their families know it, and everyone else knows it, too!
Look at their past, look at their record. They don’t have what it takes, and they never did! They’ve all been thrown off Television, lost their Shows, and aren’t even invited on TV because nobody cares about them, they’re NUT JOBS, TROUBLEMAKERS, and will say anything necessary for some “free” and cheap publicity.
Now they think they get some “clicks” because they have Third Rate Podcasts, but nobody’s talking about them, and their views are the opposite of MAGA — Or I wouldn’t have won the Presidential Election in a LANDSLIDE. MAGA agrees with me, and just gave CNN a 100% Approval Rating of “TRUMP,” not Hand Flailing Fools like Tucker Carlson, who couldn’t even finish College, he was a broken man when he got fired from Fox, and he’s never been the same — Perhaps he should see a good psychiatrist!
Or Megyn Kelly, who nastily asked me the now famous, “Only Rosie O’Donnell,” question, or “Crazy” Candace Owens, who accuses the Highly Respected First Lady of France of being a man, when she is not, and will hopefully win lots of money in the ongoing lawsuit. Actually, to me, the First Lady of France is a far more beautiful woman than Candace, in fact, it’s not even close!
Or Bankrupt Alex Jones, who says some of the dumbest things, and lost his entire fortune, as he should have, for his horrendous attack on the families of the Sandy Hook shooting victims, ridiculously claiming it was a hoax.
These so-called “pundits” are LOSERS, and they always will be! Now Fake News CNN, The Failing New York Times, and all of the other Radical Left “News” Organizations, are “hailing” them, and giving them “positive” press for the first time in their lives. They’re not “MAGA,” they’re losers, just trying to latch on to MAGA.
As President, I could get them on my side anytime I want to, but when they call, I don’t return their calls because I’m too busy on World and Country Affairs and, after a few times, they go “nasty,” just like Marjorie “Traitor” Brown, but I no longer care about that stuff, I only care about doing right for our Country.
MAGA is about WINNING and STRENGTH in not allowing Iran to have Nuclear Weapons. MAGA is about MAKING AMERICA GREAT AGAIN, and these people have no idea how to do that, BUT I DO, because THE UNITED STATES IS NOW THE “HOTTEST” COUNTRY ANYWHERE IN THE WORLD!
tweet
President Trump: I know why Tucker Carlson, Megyn Kelly, Candace Owens, and Alex Jones have all been fighting me for years, especially by the fact that they think it is wonderful for Iran, the Number One State Sponsor of Terror, to have a Nuclear Weapon - Because they have one thing in common, Low IQs. They’re stupid people, they know it, their families know it, and everyone else knows it, too!
Look at their past, look at their record. They don’t have what it takes, and they never did! They’ve all been thrown off Television, lost their Shows, and aren’t even invited on TV because nobody cares about them, they’re NUT JOBS, TROUBLEMAKERS, and will say anything necessary for some “free” and cheap publicity.
Now they think they get some “clicks” because they have Third Rate Podcasts, but nobody’s talking about them, and their views are the opposite of MAGA — Or I wouldn’t have won the Presidential Election in a LANDSLIDE. MAGA agrees with me, and just gave CNN a 100% Approval Rating of “TRUMP,” not Hand Flailing Fools like Tucker Carlson, who couldn’t even finish College, he was a broken man when he got fired from Fox, and he’s never been the same — Perhaps he should see a good psychiatrist!
Or Megyn Kelly, who nastily asked me the now famous, “Only Rosie O’Donnell,” question, or “Crazy” Candace Owens, who accuses the Highly Respected First Lady of France of being a man, when she is not, and will hopefully win lots of money in the ongoing lawsuit. Actually, to me, the First Lady of France is a far more beautiful woman than Candace, in fact, it’s not even close!
Or Bankrupt Alex Jones, who says some of the dumbest things, and lost his entire fortune, as he should have, for his horrendous attack on the families of the Sandy Hook shooting victims, ridiculously claiming it was a hoax.
These so-called “pundits” are LOSERS, and they always will be! Now Fake News CNN, The Failing New York Times, and all of the other Radical Left “News” Organizations, are “hailing” them, and giving them “positive” press for the first time in their lives. They’re not “MAGA,” they’re losers, just trying to latch on to MAGA.
As President, I could get them on my side anytime I want to, but when they call, I don’t return their calls because I’m too busy on World and Country Affairs and, after a few times, they go “nasty,” just like Marjorie “Traitor” Brown, but I no longer care about that stuff, I only care about doing right for our Country.
MAGA is about WINNING and STRENGTH in not allowing Iran to have Nuclear Weapons. MAGA is about MAKING AMERICA GREAT AGAIN, and these people have no idea how to do that, BUT I DO, because THE UNITED STATES IS NOW THE “HOTTEST” COUNTRY ANYWHERE IN THE WORLD!
tweet
WarMonitor
RT @robrousseau: Trump: I was actually talking about a totally different 10-point plan that's really good for us and bad for them, not the one that the entire world is talking about showing us giving up
Everyone: May we see it?
Trump: No
tweet
RT @robrousseau: Trump: I was actually talking about a totally different 10-point plan that's really good for us and bad for them, not the one that the entire world is talking about showing us giving up
Everyone: May we see it?
Trump: No
tweet
The Spectator Index
Long Trump post criticizing Tucker Carlson, Megyn Kelly, Candace Owens and Alex Jones. https://twitter.com/spectatorindex/status/2042341017383542996/photo/1
tweet
Long Trump post criticizing Tucker Carlson, Megyn Kelly, Candace Owens and Alex Jones. https://twitter.com/spectatorindex/status/2042341017383542996/photo/1
tweet
Disclose.tv
JUST IN - Trump calls Alex Jones, Tucker Carlson, Candace Owens and Megyn Kelly, "Low IQ... stupid people... nobody cares about them, they’re NUT JOBS, TROUBLEMAKERS." https://twitter.com/disclosetv/status/2042341322216894684/photo/1
tweet
JUST IN - Trump calls Alex Jones, Tucker Carlson, Candace Owens and Megyn Kelly, "Low IQ... stupid people... nobody cares about them, they’re NUT JOBS, TROUBLEMAKERS." https://twitter.com/disclosetv/status/2042341322216894684/photo/1
tweet
WarMonitor
Trump is lashing out at his former allies after they broke with him over the Iran war and his rhetoric. https://twitter.com/TheWarMonitor/status/2042342054210970024/photo/1
tweet
Trump is lashing out at his former allies after they broke with him over the Iran war and his rhetoric. https://twitter.com/TheWarMonitor/status/2042342054210970024/photo/1
tweet
Open Source Intel
Trump:
“Crazy” Candace Owens, who accuses the Highly Respected First Lady of France of being a man, when she is not, and will hopefully win lots of money in the ongoing lawsuit.
Actually, to me, the First Lady of France is a far more beautiful woman than Candace, in fact, it’s not even close!
tweet
Trump:
“Crazy” Candace Owens, who accuses the Highly Respected First Lady of France of being a man, when she is not, and will hopefully win lots of money in the ongoing lawsuit.
Actually, to me, the First Lady of France is a far more beautiful woman than Candace, in fact, it’s not even close!
tweet
OSINT
Photo
Open Source Intel
President Trump just went all out on Tucker, Megyn, Candace, Alex Jones and Marjorie Taylor Greene
“Low IQs.” “Third-rate podcasts.” “Losers” and for MTG “traitor” and “nasty.”
tweet
President Trump just went all out on Tucker, Megyn, Candace, Alex Jones and Marjorie Taylor Greene
“Low IQs.” “Third-rate podcasts.” “Losers” and for MTG “traitor” and “nasty.”
President Trump: I know why Tucker Carlson, Megyn Kelly, Candace Owens, and Alex Jones have all been fighting me for years, especially by the fact that they think it is wonderful for Iran, the Number One State Sponsor of Terror, to have a Nuclear Weapon - Because they have one thing in common, Low IQs. They’re stupid people, they know it, their families know it, and everyone else knows it, too!
Look at their past, look at their record. They don’t have what it takes, and they never did! They’ve all been thrown off Television, lost their Shows, and aren’t even invited on TV because nobody cares about them, they’re NUT JOBS, TROUBLEMAKERS, and will say anything necessary for some “free” and cheap publicity.
Now they think they get some “clicks” because they have Third Rate Podcasts, but nobody’s talking about them, and their views are the opposite of MAGA — Or I wouldn’t have won the Presidential Election in a LANDSLIDE. MAGA agrees with me, and just gave CNN a 100% Approval Rating of “TRUMP,” not Hand Flailing Fools like Tucker Carlson, who couldn’t even finish College, he was a broken man when he got fired from Fox, and he’s never been the same — Perhaps he should see a good psychiatrist!
Or Megyn Kelly, who nastily asked me the now famous, “Only Rosie O’Donnell,” question, or “Crazy” Candace Owens, who accuses the Highly Respected First Lady of France of being a man, when she is not, and will hopefully win lots of money in the ongoing lawsuit. Actually, to me, the First Lady of France is a far more beautiful woman than Candace, in fact, it’s not even close!
Or Bankrupt Alex Jones, who says some of the dumbest things, and lost his entire fortune, as he should have, for his horrendous attack on the families of the Sandy Hook shooting victims, ridiculously claiming it was a hoax.
These so-called “pundits” are LOSERS, and they always will be! Now Fake News CNN, The Failing New York Times, and all of the other Radical Left “News” Organizations, are “hailing” them, and giving them “positive” press for the first time in their lives. They’re not “MAGA,” they’re losers, just trying to latch on to MAGA.
As President, I could get them on my side anytime I want to, but when they call, I don’t return their calls because I’m too busy on World and Country Affairs and, after a few times, they go “nasty,” just like Marjorie “Traitor” Brown, but I no longer care about that stuff, I only care about doing right for our Country.
MAGA is about WINNING and STRENGTH in not allowing Iran to have Nuclear Weapons. MAGA is about MAKING AMERICA GREAT AGAIN, and these people have no idea how to do that, BUT I DO, because THE UNITED STATES IS NOW THE “HOTTEST” COUNTRY ANYWHERE IN THE WORLD! tweet
The Spectator Index
If the ceasefire marks the end of the war, then 'the biggest loser will be Donald Trump' as the conflict has 'set back his chief war aims and revealed the shallowness of his vision for a new way of wielding American power', according to report in The Economist. https://twitter.com/spectatorindex/status/2042344603135984071/photo/1
tweet
If the ceasefire marks the end of the war, then 'the biggest loser will be Donald Trump' as the conflict has 'set back his chief war aims and revealed the shallowness of his vision for a new way of wielding American power', according to report in The Economist. https://twitter.com/spectatorindex/status/2042344603135984071/photo/1
tweet