US Disrupts Russian Military-Run DNS Hijacking Network

Justice Department says it dismantled global hacking operation controlled by Russian intelligence unit.

Apr. 8, 2026 at 11:20am

Got story updates? Submit your updates here. ›

The U.S. Justice Department announced it has dismantled a global DNS hijacking network controlled by a Russian military intelligence unit, the GRU's Military Unit 26165, in a court-authorized disruption operation.

Why it matters

This takedown is part of ongoing efforts by U.S. authorities to disrupt malicious cyber activities by Russian state actors, which have targeted critical infrastructure and government agencies in the past. Disrupting the GRU's hacking capabilities is seen as an important step in protecting against future attacks.

The details

The Justice Department said the GRU-controlled network was used to hijack internet domain names and redirect user traffic, allowing the Russian military to conduct espionage and potentially launch future cyber attacks. The court-authorized disruption operation was designed to neutralize the network and mitigate the threat.

  • The Justice Department announced the disruption on Tuesday, April 8, 2026.

The players

US Justice Department

The U.S. federal law enforcement agency that led the operation to dismantle the Russian military-run DNS hijacking network.

GRU Military Unit 26165

A Russian military intelligence unit that was operating the global DNS hijacking network that was disrupted by U.S. authorities.

Got photos? Submit your photos here. ›

The takeaway

This disruption operation demonstrates the U.S. government's ongoing efforts to counter malicious cyber activities by Russian state actors and protect critical infrastructure and systems from potential future attacks.