GRU Operators Drained Microsoft 365 Tokens by Rewriting DNS on 18,000 SOHO Routers

Key points

• Forest Blizzard compromised more than 18,000 routers, mostly older Mikrotik and TP-Link devices, without installing any malware.
• Operators rewrote DNS settings to point queries at attacker-controlled servers, intercepting OAuth tokens after users had already cleared multi-factor authentication.
• The campaign peaked in December 2025 and targeted roughly 200 organisations and 5,000 consumer devices.
• The group pivoted to mass DNS rewriting the day after the UK's National Cyber Security Centre published a related advisory in August 2025.
• On 23 March the FCC announced it would stop certifying consumer-grade routers manufactured outside the United States.

What did Forest Blizzard actually do?

Russian military intelligence operators tracked as Forest Blizzard (also known as APT28 and Fancy Bear), attributed to the GRU (Russia's General Staff Main Intelligence Directorate), compromised more than 18,000 older Mikrotik and TP-Link routers across small-office networks. No malware touched the routers. Instead, operators exploited known, unpatched flaws to rewrite each device's DNS settings, pointing queries at virtual private servers under their control. Malicious DNS responses then reached every client on the local network, letting the attackers position themselves between users and Outlook on the web domains to intercept TLS traffic.

OAuth tokens, the credentials that prove a session is authenticated, are issued only after a user passes multi-factor authentication. Stealing the token skips MFA entirely on every subsequent request. No phishing of one-time codes was needed.

"These guys didn't use malware. They did this in an old-school, graybeard way that isn't really sexy but it gets the job done," Ryan English, a security engineer at Black Lotus Labs, said.

Research by Black Lotus Labs at Lumen and a parallel disclosure by Microsoft put the campaign's peak in December 2025. Targeting leaned toward ministries of foreign affairs, law enforcement bodies and third-party email providers. Microsoft noted this is the first time it has observed Forest Blizzard using DNS hijacking at scale to intercept TLS connections after exploiting edge devices.

Why did the group change tactics?

Before August 2025 the group used router-resident malware against a small, selected target set. Danny Adamitis, an engineer at Black Lotus Labs, told KrebsOnSecurity that the pivot happened the day after the UK's National Cyber Security Centre released its advisory on Russian router compromises. "Before the last NCSC report came out they used this capability in very limited instances. After the report was released they implemented the capability in a more systemic fashion and used it to target everything that was vulnerable," Adamitis said.

That kind of rapid tactical adjustment after a public disclosure is worth watching for now that this campaign has received the same treatment.

Should you worry about your router?

If your router is out of support, or years behind on firmware, yes. The NCSC has asked network defenders to audit edge devices for unauthorised DNS configuration changes and retire unsupported hardware. Microsoft's detection guidance for the adversary-in-the-middle activity is live. The FCC's March announcement that it will stop certifying foreign-manufactured consumer routers addresses the supply-chain angle, though analysts note few qualifying domestic products currently sit on retail shelves. Devices already purchased remain usable, and manufacturers can seek conditional approval through the Department of War or the Department of Homeland Security.

We covered Mikrotik device exposure in two stories over the past 90 days; this campaign is the clearest illustration yet of why that hardware's unpatched install base is an operational gift to a patient adversary. OAuth token theft via DNS hijacking is also the same underlying mechanic our 26 May report on the Kali365 phishing kit flagged: once you have the token, MFA is beside the point.

The routers were always the soft underbelly. Forest Blizzard just decided to use them at scale.