Q: In this task, you are given a text of many news articles seperated by special token "|||||". Your task is to summarize them.
LONDON (AP) — The FBI has put a spoke in the wheel of a major Russian digital disruption operation potentially aimed at causing havoc in Ukraine, evidence pieced together from researchers, Ukrainian officials and U.S. court documents indicates. 
  
 On Wednesday, network technology company Cisco Systems and antivirus company Symantec warnedthat a half-million internet-connected routers had been compromised in a possible effort to lay the groundwork for a cyber-sabotage operation against targets in Ukraine. 
  
 Court documents simultaneously unsealed in Pittsburgh show the FBI has seized a key website communicating with the massive army of hijacked devices, disrupting what could have been — and might still be — an ambitious cyberattack by the Russian government-aligned hacking group widely known as Fancy Bear. 
  
 "I hope it catches the actors off guard and leads to the downfall of their network," said Craig Williams, the director of outreach for Talos, the digital threat intelligence unit of Cisco that cooperated with the bureau. But he warned that the hackers could still regain control of the infected routers if they possessed their addresses and the right resources to re-establish command and control. 
  
 FBI Assistant Director Scott Smith said the agency "has taken a critical step in minimizing the impact of the malware attack. While this is an important first step, the FBI's work is not done." 
  
 Much about the hackers' motives remains open to conjecture. Cisco said the malicious software, which it and Symantec both dubbed VPNFilter after a folder it creates, was sitting on more than 500,000 routers in 54 countries but mostly in Ukraine, and had the capacity to render them unusable — a massively disruptive move if carried out at such a scale. 
  
 "It could be a significant threat to users around the world," said Williams. 
  
 The U.S. Justice Department said the malware "could be used for a variety of malicious purposes, including intelligence gathering, theft of valuable information, destructive or disruptive attacks, and the misattribution of such activities." 
  
 Ukraine's cyberpolice said in a statement that it was possible the hackers planned to strike during "large-scale events," an apparent reference either to the upcoming Champions League game between Real Madrid and Liverpool in the capital, Kiev, on Saturday or to Ukraine's upcoming Constitution Day celebrations. 
  
 Ukraine has been locked in a years-long struggle with Russia-backed separatists in the country's east and has repeatedly been hit by cyberattacks of escalating severity. Last year witnessed the eruption of the NotPetya worm, which crippled critical systems, including hospitals , across the country and dealt hundreds of millions of dollars in collateral damage around the globe. Ukraine, the United States and Britain have blamed the attack on Moscow — a charge the Kremlin has denied. 
  
 Cisco and Symantec both steered clear of attributing the VPNFilter malware to any particular actor, but an FBI affidavit explicitly attributed it to Fancy Bear, the same group that hacked into the Democratic National Committee in 2016 and has been linked to a long series of digital intrusions stretching back more than a decade. The U.S. intelligence community assesses that Fancy Bear acts on behalf of Russia's military intelligence service. 
  
 An FBI affidavit — whose existence was first reported by The Daily Beast — said the hackers used lines of code hidden in the metadata of online photo albums to communicate with their network of seeded routers. If the photo albums disappeared, the hackers turned to a fallback website — the same site whose seizure the FBI ordered Tuesday. 
  
 An email sent to the website's registered owner was returned as undeliverable. 
  
 When asked why the FBI specifically named Fancy Bear where Cisco did not, Williams noted that while attribution was extremely tricky based on malware analysis alone, "if you combine that knowledge with a traditional intelligence apparatus interesting things can come to light." 
  
 In any case, he said, "we have a high degree of confidence that the actor behind this is acting against the Ukraine's best interest." 
  
 Cisco said in a research note that the malware affected devices geared for small and home offices from manufacturers including Netgear, TP-Link and Linksys and had the potential to disable "internet access for hundreds of thousands of victims worldwide or in a focused region." 
  
 The malware's principal capabilities, the company said, included stealthy intelligence-collecting, monitoring industrial-control software and, if triggered, "bricking" or disabling routers. It also persists on the infected routers after they are rebooted. 
  
 ___ 
  
 Bajak reported from Boston. Chad Day in Washington contributed to this report. 
  
 ___ 
  
 Court documents: https://www.documentcloud.org/documents/4482618-VPNFilter-FBI-affidavit.html 
  
 Talos' blog post: https://blog.talosintelligence.com/2018/05/VPNFilter.html ||||| The FBI is advising users of consumer-grade routers and network-attached storage devices to reboot them as soon as possible to counter Russian-engineered malware that has infected hundreds of thousands devices. 
  
 Researchers from Cisco’s Talos security team first disclosed the existence of the malware on Wednesday. The detailed report said the malware infected more than 500,000 devices made by Linksys, Mikrotik, Netgear, QNAP, and TP-Link. Known as VPNFilter, the malware allowed attackers to collect communications, launch attacks on others, and permanently destroy the devices with a single command. The report said the malware was developed by hackers working for an advanced nation, possibly Russia, and advised users of affected router models to perform a factory reset, or at a minimum to reboot. 
  
 Limited persistence 
  
 Later in the day, The Daily Beast reported that VPNFilter was indeed developed by a Russian hacking group , one known by a variety of names, including Sofacy, Fancy Bear, APT 28, and Pawn Storm. The Daily Beast also said the FBI had seized an Internet domain VPNFilter used as a backup means to deliver later stages of the malware to devices that were already infected with the initial stage 1. The seizure meant that the primary and secondary means to deliver stages 2 and 3 had been dismantled, leaving only a third fallback, which relied on attackers sending special packets to each infected device. 
  
 The redundant mechanisms for delivering the later stages address a fundamental shortcoming in VPNFilter—stages 2 and 3 can’t survive a reboot, meaning they are wiped clean as soon as a device is restarted. Instead, only stage 1 remains. Presumably, once an infected device reboots, stage 1 will cause it to reach out to the recently seized ToKnowAll.com address. The FBI’s advice to reboot small office and home office routers and NAS devices capitalizes on this limitation. In a statement published Friday, FBI officials suggested that users of all consumer-grade routers, not just those known to be vulnerable to VPNFilter, protect themselves. The officials wrote: 
  
 The FBI recommends any owner of small office and home office routers reboot the devices to temporarily disrupt the malware and aid the potential identification of infected devices. Owners are advised to consider disabling remote management settings on devices and secure with strong passwords and encryption when enabled. Network devices should be upgraded to the latest available versions of firmware. 
  
 In a statement also published Friday, Justice Department officials wrote: 
  
 Owners of SOHO and NAS devices that may be infected should reboot their devices as soon as possible, temporarily eliminating the second stage malware and causing the first stage malware on their device to call out for instructions. Although devices will remain vulnerable to reinfection with the second stage malware while connected to the Internet, these efforts maximize opportunities to identify and remediate the infection worldwide in the time available before Sofacy actors learn of the vulnerability in their command-and-control infrastructure. 
  
 The US Department of Homeland Security has also issued a statement advising that "all SOHO router owners power cycle (reboot) their devices to temporarily disrupt the malware." 
  
 As noted in the statements, rebooting serves the objectives of (1) temporarily preventing infected devices from running the stages that collect data and other advanced attacks and (2) helping FBI officials to track who was infected. Friday’s statement said the FBI is working with the non-profit Shadow Foundation to disseminate the IP addresses of infected devices to ISPs and foreign authorities to notify end users. 
  
 Authorities and researchers still don’t know for certain how compromised devices are initially infected. They suspect the attackers exploited known vulnerabilities and default passwords that end users had yet to patch or change. That uncertainty is likely driving the advice in the FBI statement that all router and NAS users reboot, rather than only users of the 14 models known to be affected by VPNFilter, which are: 
  
 Linksys E1200 
  
 Linksys E2500 
  
 Linksys WRVS4400N 
  
 Mikrotik RouterOS for Cloud Core Routers: Versions 1016, 1036, and 1072 
  
 Netgear DGN2200 
  
 Netgear R6400 
  
 Netgear R7000 
  
 Netgear R8000 
  
 Netgear WNR1000 
  
 Netgear WNR2000 
  
 QNAP TS251 
  
 QNAP TS439 Pro 
  
 Other QNAP NAS devices running QTS software 
  
 TP-Link R600VPN 
  
 The advice to reboot, update, change default passwords, and disable remote administration is sound and in most cases requires no more than 15 minutes. Of course, a more effective measure is to follow the advice Cisco gave Wednesday to users of affected devices and perform a factory reset, which will permanently remove all of the malware, including stage 1. This generally involves using a paper clip or thumb tack to hold down a button on the back of the device for 5 seconds. The reset will remove any configuration settings stored on the device, so users will have to restore those settings once the device initially reboots. (It's never a bad idea to disable UPnP when practical, but that protection appears to have no effect on VPNFilter.) 
  
 There's no easy way to know if a router has been infected by VPNFilter. For more advanced users, Cisco provided detailed indicators of compromise in Wednesday’s report, along with firewall rules that can be used to protect devices. Ars has much more about VPNFilter here. |||||
A:
Reboot your internet router now. That's what the FBI is telling the users of some 500,000 devices believed to be infected with powerful Russian malware capable of intelligence-collecting, software monitoring, and disabling routers, according to the New York Times. Network technology company Cisco Systems and antivirus company Symantec first issued a warning on Wednesday about the routers, which the company said have been compromised in a possible effort to lay the groundwork for a cyber-sabotage operation against targets in Ukraine, per the AP. According to ArsTechnica, the so-called VPNFilter malware uses three distinct stages in order to send gathered data back to the dark actors, who've been identified as the Russian government-linked hacker group Fancy Bear. While the first stage can survive rebooting, the second and third reportedly cannot. Routers from Linksys, Mikrotik, Netgear, QNAP, and TP-Link are reportedly those vulnerable to the malware, but the FBI recommended Friday that any owner of small office and home office routers "reboot the devices to temporarily disrupt the malware and aid the potential identification of infected devices." The FBI advised router owners to consider disabling remote management settings on devices and to secure routers with strong passwords and encryption whenever possible. Network devices should also be upgraded to the latest available versions of firmware, the FBI said. The group Fancy Bear reportedly is known by many other names, including Sofacy, APT 28, and Pawn Storm, and is believed to be the party responsible for the 2016 DNC hack.