Russian intelligence spies on EU, US,and Ukrainian citizens via hacked routers – SSU

According to Ukrinform, the SSU press center reported this on its website.

"As a result of the international cyber operation, numerous cases were uncovered of Russian military intelligence (better known as the GRU) hacking office and home Wi-Fi routers of Ukrainian and foreign citizens (so-called SOHO equipment)," the statement said.

According to the investigation, Russian operatives targeted routers that did not meet modern security protocols.

After gaining access to vulnerable internet devices, the attackers redirected traffic through a pre-established network of DNS servers (which convert internet resource names into IP addresses that uniquely identify destination servers). In this way, they acted as "middlemen" in the online space to collect passwords, authentication tokens, and other sensitive information, including emails that are normally protected by cryptographic protocols such as SSL (Secure Sockets Layer) and TLS (Transport Layer Security).

"The information obtained was intended to be used for cyberattacks, information sabotage, and intelligence gathering," the SSU emphasized.

In particular, Russian intelligence focused on data exchanged by employees and military personnel of government bodies, units of Ukraine's Defense Forces, and enterprises of the defense-industrial complex.

As a result of the joint cyber operation, more than 100 servers were blocked and hundreds of routers in Ukraine alone were taken out of enemy control, significantly weakening the intelligence capabilities of Russia's military intelligence and preventing potential destruction of equipment at the software level.

The SSU and its Western partners are continuing comprehensive measures to bring all those involved in the cybercrimes to justice.

The SSU also recommends that all router owners check their device model and current software version, ensure that the latest security updates are installed, and apply them immediately if not.

"If support from the manufacturer is no longer available, we strongly advise replacing the router with a more modern model, including from another company. After updating, it is essential to change the access password, disable remote access to the control panel from the Internet, check settings, and remove anything suspicious. We also ask telecom providers to assist their customers in implementing these cybersecurity measures," the SSU stressed.

As Ukrinform previously reported, in March Germany's Federal Prosecutor's Office detained a Romanian citizen and a Ukrainian citizen suspected of spying for Russian intelligence – they were gathering information and filming a person supplying drones and components for Ukraine.