Russian State-Linked APT28 Exploits SOHO Routers in Global DNS Hijacking Campaign

This article covers APT28 (Forest Blizzard), a Russia-linked threat actor, conducting a large-scale DNS hijacking campaign by compromising SOHO routers worldwide.

• •The campaign, codenamed FrostArmada, targeted MikroTik and TP-Link routers by modifying DNS settings to redirect traffic to attacker-controlled servers.
• •At peak activity in December 2025, over 18,000 unique IP addresses from 120+ countries communicated with APT28 infrastructure.
• •Attackers used Attacker-in-the-Middle (AitM) techniques to steal passwords, OAuth tokens, and credentials for email and web services.
• •TP-Link WR841N routers were exploited via CVE-2023-50224, an authentication bypass vulnerability with a CVSS score of 6.5.
• •The campaign primarily targeted government agencies including foreign ministries and law enforcement across Africa, Central America, Southeast Asia, and Europe.

This summary was automatically generated by AI based on the original article and may not be fully accurate.