Romania’s SRI helped FBI to disrupt GRU-led global spy network stealing military data, president says

The Federal Bureau of Investigation (FBI), together with several partners, including the Romanian Intelligence Service (SRI), disrupted a prolonged cyberattack network targeting sensitive infrastructure in several Western states, president Nicusor Dan said on April 8.

“Cyber actors associated with the GRU, the intelligence service of the Russian army, were collecting military, governmental, and critical infrastructure-related information. Russia is therefore continuing its hybrid war against Western countries, and only those acting in bad faith fail to see this. Romania must improve its cybersecurity and continue to cooperate with its Western partners,” president Dan wrote on Facebook.

According to a statement from the FBI, a GRU network using compromised routers worldwide to intercept and steal sensitive military, government, and critical infrastructure information was dismantled.

“At least since 2024, cyber actors from GRU’s Main Centre for Special Services 85 (85 GTsSS) — also known as APT28, Fancy Bear, and Forest Blizzard — have been collecting authentication data and exploiting vulnerable routers globally, including compromising TP-Link routers using CVE-2023-50224,” the statement notes.

(Photo: Tack One Photo/ Dreasmtime)