Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Cybersecurity topic
No spam. Unsubscribe anytime.
FBI cyber chief announces Operation Masquerade to disrupt Russian GRU infrastructure
Summary
Brett Leatherman, head of the FBI Cyber Division, announced "Operation Masquerade," a court‑authorized technical operation the FBI executed to harden compromised routers in the U.S. after a DNS‑hijacking campaign linked to Russia's GRU. The FBI said it tested the measures first and released a PSA with NSA and 15 partner countries.
Brett Leatherman, head of the Federal Bureau of Investigation's Cyber Division, announced a global campaign called "Operation Masquerade" in which the FBI, the Department of Justice and international partners moved to disrupt Russian GRU infrastructure the bureau says was being used to steal government and military information and to target critical infrastructure.
"Today, the FBI and DOJ along with international partners are announcing Operation Masquerade, a worldwide effort to disrupt Russian GRU infrastructure used to steal government and military information and to target critical infrastructure," Leatherman said.
Leatherman said the activity, attributed to Russian military intelligence, has run "since at least 2024" and involved DNS hijacking that compromised routers and redirected traffic from connected devices such as phones and laptops to GRU‑controlled infrastructure. He told listeners the GRU had affected a large number of household routers worldwide and routers used by small and medium‑sized businesses to reach high‑value intelligence targets.
"Given the scale of this campaign, we needed to act," Leatherman said. To do so, he said, the FBI developed and executed a court‑authorized technical operation to harden compromised routers across the United States. According to Leatherman, bureau commands reverted manipulated DNS settings, collected evidence, cut off GRU access to compromised U.S. devices and took steps to prevent reexploitation.
Leatherman said the FBI conducted extensive testing before carrying out the operation to ensure router functionality and to avoid affecting legitimate users' information. He did not specify the number of routers affected or the court order that authorized the activity; those details were described in the briefing as "court‑authorized" but no case name or docket number was provided in the transcript.
The FBI also released a public service announcement co‑authored with the National Security Agency and partners from 15 countries that, the bureau said, details the GRU's techniques and offers defensive guidance for network operators and users.
Leatherman framed the action as part of the FBI's mission to defend the homeland and said the bureau works daily with partners to disrupt adversary operations, publish advisories and support victims. He closed the briefing by thanking attendees.
