Russian Intelligence Unit Forest Blizzard Uses DNS Hijacking to Mass

What happened

Security researchers say the Russian intelligence-linked group known as Forest Blizzard hijacked more than 18,000 routers in order to steal Microsoft Office authentication tokens at scale. The campaign reportedly relied on DNS hijacking through older, vulnerable edge devices rather than traditional endpoint malware. By compromising routers and redirecting traffic through attacker-controlled infrastructure, the operators were able to intercept OAuth tokens after victims had already authenticated, giving them account access without having to defeat credentials directly at the login page.

That makes the campaign particularly serious because it attacks trust in the network path itself. Instead of infecting the victim's laptop, the attackers manipulate the device sitting between the user and the internet.

What's new in this update

The most important development is the scale and the method together. Researchers from Microsoft and Lumen's Black Lotus Labs say this is not just another APT28 operation. It is a large, infrastructure-centric espionage campaign using end-of-life or poorly maintained routers as the entry point for adversary-in-the-middle interception. That tactic lets the attackers bypass some of the visibility and detection logic that organizations have spent years building around malware, EDR tooling, and endpoint compromise.

It also exposes a harsh operational truth: organizations may invest heavily in identity protection and MFA while still leaving older network devices weak enough to undermine the whole chain.

Key details

The targeted hardware reportedly included unsupported or unpatched Mikrotik and TP-Link routers. Once attackers gained control, they altered DNS settings so user traffic resolved through hostile infrastructure. When victims authenticated into Microsoft services, the attackers intercepted the resulting OAuth or session-related artifacts and used them to access accounts directly.

Several factors make the operation notable:

• It relies on router compromise rather than endpoint malware.
• It can capture tokens after successful login, effectively neutralizing MFA's intended protection.
• It reportedly affected government, diplomatic, and law-enforcement networks at scale.
• It demonstrates continued strategic value in aging edge infrastructure.

This is why the campaign is so troubling for defenders. It does not need to beat the newest laptop protections if it can quietly take over the forgotten networking gear outside the office wall.

Background and context

Forest Blizzard, also known as APT28 or Fancy Bear, has long been associated with Russia's GRU and with politically significant cyber operations. The group is known for adapting old techniques to new environments when those techniques still work. DNS manipulation is not glamorous, but it is foundational. If an attacker can alter name resolution or reroute traffic through a malicious vantage point, many modern controls become less effective.

This is especially dangerous in small-office, branch-office, and remote environments where routers may stay in service for years after vendor support degrades. In such environments, the edge device often becomes the weakest link in an otherwise well-defended identity stack.

What to watch next

The immediate question is how quickly organizations replace or harden vulnerable network devices, especially in government and critical-administration environments. Token theft campaigns are difficult enough when the compromise sits on the endpoint; when the compromise sits in the routing layer, detection and remediation become even more complex.

Researchers will also watch whether Forest Blizzard shifts tactics now that the method is public. But even if this specific infrastructure is disrupted, the broader lesson remains: attackers will keep targeting neglected routers as long as they provide a quiet route around stronger endpoint and identity defenses.

Why this matters

This matters because Forest Blizzard, APT28, Fancy Bear, Microsoft Office, DNS hijacking, OAuth token theft, and GRU-linked cyber operations all converge on one uncomfortable conclusion: modern security controls can be bypassed if legacy network infrastructure is left exposed. The campaign shows that state actors do not always need zero-days or novel malware to break in. Sometimes they only need thousands of forgotten routers and a protocol old enough that defenders stopped paying attention to it.

Reader context

This story belongs to Northstar Herald's Cybersecurity and National Security coverage, with related entities including Forest Blizzard, APT28, Fancy Bear, Microsoft. The report is based on Krebs on Security source material.

Related coverage

• More security coverage
• Cybersecurity updates