Inside the FBI\u2019s router takedown that cut off APT28\u2019s \u2018tremendous access\u2019 | CyberScoop<\/title> <meta name=\"description\" content=\"FBI Assistant Director Brett Leatherman reveals how "Operation Masquerade" dismantled a "virtually invisible" Russian GRU cyber campaign that hijacked 18,000 routers to spy on home and office traffic worldwide.\"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/fbi-operation-masquerade-russian-gru-router-takedown-brett-leatherman\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"Inside the FBI\u2019s router takedown that cut off APT28\u2019s \u2018tremendous access\u2019\"> <meta property=\"og:description\" content=\"FBI Assistant Director Brett Leatherman reveals how "Operation Masquerade" dismantled a "virtually invisible" Russian GRU cyber campaign that hijacked 18,000 routers to spy on home and office traffic worldwide.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/fbi-operation-masquerade-russian-gru-router-takedown-brett-leatherman\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/cyberscoop\/\"> <meta property=\"article:published_time\" content=\"2026-04-09T15:34:14+00:00\"> <meta property=\"article:modified_time\" content=\"2026-04-09T15:34:17+00:00\"> <meta property=\"og:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/inside-the-fbis-router-takedown-that-cut-off-apt28s-tremendous-access-2.jpg\"> <meta property=\"og:image:width\" content=\"2121\"> <meta property=\"og:image:height\" content=\"1414\"> <meta property=\"og:image:type\" content=\"image\/jpeg\"> <meta name=\"author\" content=\"Tim Starks\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:creator\" content=\"@timstarks\"> <meta name=\"twitter:site\" content=\"@CyberScoopNews\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1774626878g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress\/dist\/css\/related-posts-block-styles.min.css?m=1775074092g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1775068334g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=13897d660a0ac2c9c7d1\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" title=\"JSON\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/88541\"><meta name=\"generator\" content=\"WordPress 6.8.5\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=88541\">\n<link rel=\"alternate\" title=\"oEmbed (JSON)\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Ffbi-operation-masquerade-russian-gru-router-takedown-brett-leatherman%2F\">\n<link rel=\"alternate\" title=\"oEmbed (XML)\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Ffbi-operation-masquerade-russian-gru-router-takedown-brett-leatherman%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"wp-singular post-template-default single single-post postid-88541 single-format-standard wp-theme-scoopnewsgroup wp-child-theme-cyberscoop\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/fbi-operation-masquerade-russian-gru-router-takedown-brett-leatherman\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--newsletter js-stickybar\" readability=\"0.82\"> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"25.429928741093\">\n<div class=\"single-article__header-content\" readability=\"34.492610837438\">\n<p> FBI cyber chief Brett Leatherman told CyberScoop the Russian GRU campaign was unique in how it could propagate from routers to beyond. <\/p>\n<p>  <br \/>\n<audio id=\"audio-player\" src=\"https:\/\/wp-tts-cdn.api.scpnewsgrp.com\/cyberscoop\/88541\/english.openai.mp3\"><\/audio> <\/p>\n<div readability=\"11\">\n<div>\n<p>Listen to this article<\/p>\n<p>  <\/p>\n<p>0:00<\/p>\n<\/p><\/div>\n<p>  <\/p>\n<p> <span id=\"tts-tooltip\">Learn more.<\/span> <span> This feature uses an automated voice, which may result in occasional errors in pronunciation, tone, or sentiment. <\/span> <\/p>\n<\/div>\n<p>  <\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"426\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/inside-the-fbis-router-takedown-that-cut-off-apt28s-tremendous-access.jpg?resize=640%2C426&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/inside-the-fbis-router-takedown-that-cut-off-apt28s-tremendous-access-2.jpg 2121w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/inside-the-fbis-router-takedown-that-cut-off-apt28s-tremendous-access-2.jpg?resize=300,200 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/inside-the-fbis-router-takedown-that-cut-off-apt28s-tremendous-access-2.jpg?resize=768,512 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/inside-the-fbis-router-takedown-that-cut-off-apt28s-tremendous-access-2.jpg?resize=1024,683 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/inside-the-fbis-router-takedown-that-cut-off-apt28s-tremendous-access-2.jpg?resize=1536,1024 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/inside-the-fbis-router-takedown-that-cut-off-apt28s-tremendous-access-2.jpg?resize=2048,1365 2048w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/inside-the-fbis-router-takedown-that-cut-off-apt28s-tremendous-access-2.jpg?resize=600,400 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/inside-the-fbis-router-takedown-that-cut-off-apt28s-tremendous-access-2.jpg?resize=252,168 252w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/inside-the-fbis-router-takedown-that-cut-off-apt28s-tremendous-access-2.jpg?resize=506,337 506w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/inside-the-fbis-router-takedown-that-cut-off-apt28s-tremendous-access-2.jpg?resize=1013,675 1013w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/inside-the-fbis-router-takedown-that-cut-off-apt28s-tremendous-access-2.jpg?resize=1265,843 1265w\" sizes=\"(max-width: 1013px) 100vw, 1013px\"><figcaption> (Getty Images) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"38.927075812274\"><body readability=\"81.536121673004\"><\/p>\n<p>The recent FBI-led operation to knock Russian government hackers off routers sought to topple an especially insidious and threateningly contagious cyberespionage campaign, top bureau cyber official Brett Leatherman told CyberScoop.<\/p>\n<p>Researchers, along with U.S. and foreign government agencies, <a href=\"https:\/\/cyberscoop.com\/forest-blizzard-apt28-routers-espionage-campaign-operation-masquerade\/\">revealed details of the campaign<\/a> this week by which APT28 \u2014 also known as Forest Blizzard or Fancy Bear, and attributed to Russia\u2019s Main Intelligence Directorate of the General Staff (GRU) \u2014 compromised more 18,000 TP-Link routers and infiltrated more than 200 organizations worldwide. <\/p>\n<p>The compromise of routers used in small and home offices prompted the takedown operation, Operation Masquerade, which involved sending commands to the routers to reset Domain Name System (DNS) settings to prevent the hackers from exploiting that access.<\/p>\n<p>\u201cWhat\u2019s unique to me in this one is that when you change the internet settings in a router like they did, it propagates to all the devices in your house,\u201d Leatherman, assistant director of the FBI\u2019s cyber division, said. \u201cAll those devices now, once they\u2019re connected to that Wi-Fi, are getting the malicious IP addresses that they are then routing their traffic through, and it gives the Russian GRU tremendous access to the content offered through a router itself.\u201d<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>\u201cThe difficulty in an attack like this is that it\u2019s virtually invisible to the end users,\u201d he said. \u201cActors were not deploying malware like we often see. And so when you think about endpoint detection on your computer or something like that, it\u2019s not seeing that activity because they don\u2019t have to. They\u2019re using the tools on the router itself to capture your internet traffic and extend it throughout the house, and so traditional tools that detect that activity [are] just not there.\u201d<\/p>\n<p>The disruption operation is in line with the <a href=\"https:\/\/cyberscoop.com\/trump-cybersecurity-strategy\/\">cyber strategy<\/a> the Trump administration published last month, with its emphasis on going on offense against malicious hackers and protecting critical infrastructure, Leatherman said.<\/p>\n<p>The FBI understands its role in implementing that strategy, he said, and worked with the Office of the National Cyber Director and other agencies in developing it. The White House has kept the public and <a href=\"https:\/\/www.cybersecuritydive.com\/news\/congress-white-house-cybersecurity-strategy-iran-cisa-cve\/815628\/\">Capitol Hill<\/a> in the dark about strategy implementation, however.<\/p>\n<p>\u201cWe\u2019ve got a long track record of leveraging unique authorities and capabilities to counter these actors, to impose costs, and through the 56 field offices to really defend critical infrastructure,\u201d Leatherman said. \u201cThat\u2019s part of our DNA, really. And so we want to make sure that we continue to align that in the most scalable and agile way we can, to align with the priorities of the strategy itself.\u201d<\/p>\n<p>Leatherman traced how Operation Masquerade \u2014 the success of which he credited to the FBI\u2019s Boston offices and partnerships with the private sector and foreign governments \u2014 fits into a series of disruptions aimed at Russian government hackers dating back to 2018.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>That\u2019s when the bureau took on the <a href=\"https:\/\/cyberscoop.com\/vpnfilter-botnet-fbi-seizure-apt-28-fancy-bear\/\">VPNFilter botnet<\/a> by seizing a domain used to communicate with infected routers. In 2022, the FBI took on the <a href=\"https:\/\/cyberscoop.com\/doj-cybercrime-disruption-ransomware\/\">Cyclops Blink botnet<\/a>, and in 2024, Operation Dying Ember went after <a href=\"https:\/\/www.justice.gov\/archives\/opa\/pr\/justice-department-conducts-court-authorized-disruption-botnet-controlled-russian\">another botnet<\/a>.<\/p>\n<p>\u201c\u201dOver the course of those four operations, while the adversary continued to evolve in their tradecraft, so did we,\u201d Leatherman said. \u201cWe moved from just sinkholing domains to actually taking steps that block them at the door of these routers, pulled any capability off of those routers so they were no longer able to collect the sensitive information, and then prohibited them from getting back in.\u201d<\/p>\n<p> <\/body> <\/p>\n<footer class=\"single-article__footer\">\n<div class=\"author-card\" readability=\"7.7216117216117\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2026\/04\/inside-the-fbis-router-takedown-that-cut-off-apt28s-tremendous-access-1.jpg?w=640&ssl=1\" alt=\"Tim Starks\"> <\/figure>\n<\/p><\/div>\n<div class=\"author-card__details\" readability=\"10.901098901099\">\n<h4 class=\"author-card__name\">Written by Tim Starks<\/h4>\n<p> Tim Starks is senior reporter at CyberScoop. His previous stops include working at The Washington Post, POLITICO and Congressional Quarterly. An Evansville, Ind. native, he’s covered cybersecurity since 2003. Email Tim here: <a href=\"mailto:tim.starks@cyberscoop.com\">tim.starks@cyberscoop.com<\/a>. <\/div>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/fbi-operation-masquerade-russian-gru-router-takedown-brett-leatherman\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Inside the FBI\u2019s router takedown that cut off APT28\u2019s \u2018tremendous<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[3460,4522,5623,313,6361,30,1505,669,6337,117,466,2815,270,310,288,2481,6362],"tags":[3463,4523,5626,316,6363,38,1508,671,6340,119,470,2822,276,311,294,2483,6364],"class_list":["post-8514","post","type-post","status-publish","format-standard","hentry","category-apt28","category-brett-leatherman","category-cyber-strategy","category-cyberespionage","category-cyclopsblink","category-dns","category-fancy-bear","category-federal-bureau-of-investigation-fbi","category-forest-blizzard","category-government","category-gru","category-routers","category-russia","category-technology","category-threats","category-tp-link-technologies","category-vpnfilter","tag-apt28","tag-brett-leatherman","tag-cyber-strategy","tag-cyberespionage","tag-cyclopsblink","tag-dns","tag-fancy-bear","tag-federal-bureau-of-investigation-fbi","tag-forest-blizzard","tag-government","tag-gru","tag-routers","tag-russia","tag-technology","tag-threats","tag-tp-link-technologies","tag-vpnfilter"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/apt28\/\" rel=\"category tag\">APT28<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/brett-leatherman\/\" rel=\"category tag\">Brett Leatherman<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cyber-strategy\/\" rel=\"category tag\">cyber strategy<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cyberespionage\/\" rel=\"category tag\">cyberespionage<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cyclopsblink\/\" rel=\"category tag\">CyclopsBlink<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/dns\/\" rel=\"category tag\">DNS<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/fancy-bear\/\" rel=\"category tag\">Fancy Bear<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/federal-bureau-of-investigation-fbi\/\" rel=\"category tag\">Federal Bureau of Investigation (FBI)<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/forest-blizzard\/\" rel=\"category tag\">Forest Blizzard<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/government\/\" rel=\"category tag\">Government<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/gru\/\" rel=\"category tag\">GRU<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/routers\/\" rel=\"category tag\">routers<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/russia\/\" rel=\"category tag\">Russia<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/technology\/\" rel=\"category tag\">Technology<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/threats\/\" rel=\"category tag\">Threats<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/tp-link-technologies\/\" rel=\"category tag\">TP-Link Technologies<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/vpnfilter\/\" rel=\"category tag\">VPNfilter<\/a>","tag_info":"VPNfilter","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/8514","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=8514"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/8514\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=8514"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=8514"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=8514"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":8514,"date":"2026-04-09T10:34:14","date_gmt":"2026-04-09T15:34:14","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=88541"},"modified":"2026-04-09T10:34:14","modified_gmt":"2026-04-09T15:34:14","slug":"inside-the-fbis-router-takedown-that-cut-off-apt28s-tremendous-access","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2026\/04\/09\/inside-the-fbis-router-takedown-that-cut-off-apt28s-tremendous-access\/","title":{"rendered":"Inside the FBI\u2019s router takedown that cut off APT28\u2019s \u2018tremendous access\u2019"},"content":{"rendered":"