The United States Federal Bureau of Investigation has disrupted a Russian-controlled botnet targeted at home office networks. This operation involved the FBI targeting the threat organization Sandworm, a GRU Russian military intelligence cyber unit, and the core malware framework utilized to control the bots, Cyclops Blink. Operationally, the FBI copied and removed malicious payloads from vulnerable internet-facing firewall devices which were used as command-and-control nodes for the botnet. While there was no access into the malware utilized by Sandworm, the act of disabling the command-and-control mechanisms on the affected devices severed access from Sandworm’s control. Even though this operation did prevent thousands of compromised devices from being utilized as bots, the majority of the originally infected devices are still operational within the greater botnet. WatchGuard, the primary manufacturer of the Cyclops Blink vulnerable devices, has released a set of detection and remediation tools for all users to utilize to further protect any WatchGuard devices living on their networks. CTIX urges network administrators and security personnel to ensure that all devices, including WatchGuard devices, are up to date to lessen the chance of threat actor compromise.