Russia Hijacked 18,000 Routers Across 120 Countries to Steal Microsoft Office Tokens. No Malware. No Code. Just DNS. The FBI Just Shut It Down.

WHAT HAPPENED

Microsoft, Lumen's Black Lotus Labs, and the U.K.'s National Cyber Security Centre disclosed today that APT28, the GRU-linked threat actor also known as Forest Blizzard and Fancy Bear, has been running a DNS hijacking campaign against Microsoft Office users since at least 2024. The FBI simultaneously announced a court-authorized operation to reset the compromised routers and remove the attacker's DNS configurations.

The campaign, which Black Lotus Labs tracks as FrostArmada, targeted small office and home office routers made by MikroTik and TP-Link. These are cheap, widely deployed devices that rarely receive firmware updates and are often exposed to the internet with default credentials or known vulnerabilities that have never been patched. APT28 did not need to write custom malware for them. They used known flaws to log in, change the DNS settings, and leave.

Microsoft reported identifying more than 200 organizations and 5,000 consumer devices caught up in the operation. At its peak in December 2025, FrostArmada had compromised 18,000 devices across 120 countries. The primary targets were government agencies, law enforcement, IT and hosting providers, and organizations that operate their own servers. The geographic scope was global, but the intelligence collection focused on entities of strategic interest to Russian military intelligence.

HOW THE ATTACK WORKED

The elegance of this operation is in its simplicity. DNS is the system that translates human-readable domain names into IP addresses. Every device on every network relies on it for every connection. When APT28 changed the DNS settings on a compromised router, every device behind that router started resolving domain names through attacker-controlled servers instead of the legitimate DNS infrastructure provided by the ISP.

Most DNS queries passed through normally. The attackers implemented an automated filtering process to determine which requests were interesting and which could be ignored. When the filter identified authentication traffic to targeted Microsoft domains, the attacker's DNS servers returned spoofed responses that redirected those specific connections to infrastructure set up to perform adversary-in-the-middle attacks on TLS connections to Microsoft Outlook on the web.

The result was captured Microsoft login credentials and OAuth tokens, harvested silently from users who had no idea their router had been compromised. No phishing email was needed. No malicious attachment. No suspicious link. The user opened Outlook like they do every morning, and their authentication token was siphoned off at the DNS layer before the connection ever reached Microsoft's servers.

Black Lotus Labs engineer Danny Adamitis told KrebsOnSecurity that the approach was old-school but effective. Lumen's research identified two distinct operational teams within FrostArmada: an "Expansion team" dedicated to compromising new routers and growing the botnet, and a second team handling the credential collection and adversary-in-the-middle operations. That level of operational separation suggests a mature, well-resourced intelligence program, not an opportunistic criminal group.

ATTACK CHAIN

THE TOKEN THEFT PATTERN

This is the second major Microsoft token theft operation we have covered this week. On Sunday, we published our analysis of the 37x surge in device code phishing that is using Microsoft's own OAuth infrastructure to harvest tokens through phishing-as-a-service kits. Today's FrostArmada disclosure reveals a completely different approach to the same objective: stealing Microsoft authentication tokens at scale.

The device code phishing campaigns use social engineering to trick victims into completing authentication on legitimate Microsoft pages. FrostArmada uses DNS hijacking to intercept authentication traffic at the network layer without any user interaction at all. Different methods, same target, same result. Microsoft 365 tokens are the crown jewel of modern enterprise espionage, and both state actors and criminal groups are converging on them from every possible angle.

Microsoft's own description of the FrostArmada technique confirms the severity: this is the first time they have observed Forest Blizzard using DNS hijacking at scale to support adversary-in-the-middle attacks on TLS connections after exploiting edge devices. The technique itself is not novel, but the operational scale and the decision to target authentication infrastructure rather than individual endpoints represents an evolution in how state-sponsored actors are approaching identity compromise.

THE DISRUPTION

The FBI obtained a court-authorized order to remotely access compromised TP-Link routers and reset their DNS configurations, forcing the devices to reconnect to legitimate DNS resolvers provided by their internet service providers. The DOJ stated that the FBI extensively tested the operation on firmware and hardware for affected TP-Link routers to ensure the commands would not disrupt normal router functionality or collect user information.

Black Lotus Labs' Adamitis noted something interesting about APT28's operational awareness. After an NCSC report in August 2025 documented an earlier, smaller-scale version of this technique using malware on a targeted group of routers, APT28 immediately changed tactics. They dropped the malware-based approach and switched to the simpler DNS modification method, then expanded the operation systematically to target everything that was vulnerable. They traded sophistication for scale, and it worked.

AFFECTED INFRASTRUCTURE

DEFENSE TAKEAWAYS