Lithuania’s intelligence agency said it took part in a US-coordinated international operation to neutralise a network of compromised routers used by the APT28 cyber group linked to Russia’s military intelligence service GRU.
"It was established that this group systematically exploited vulnerable small office and home office (SOHO) routers worldwide, changing their DNS settings and redirecting internet traffic through infrastructure under their control," the State Security Department (VSD) announced on Facebook on Wednesday.
Intelligence agencies from various countries involved in the investigation report that the group has been collecting data and using vulnerable routers globally since at least 2024.
According to the intelligence service, this enabled so-called "man-in-the-middle" attacks, allowing the interception and collection of sensitive information, including login credentials, authentication tokens, email content, and other browsing data.
"The attacks were carried out on a large scale, initially compromising a high volume of devices and subsequently selecting targets of potential intelligence value, particularly those related to government institutions, the defence sector, and critical infrastructure," VSD said.
Newsletter
Every Friday morning.
