A Russian hacking group, APT28 (also known as Forest Blizzard), is suspected of running a new campaign. They infiltrated vulnerable MikroTik and TP-Link routers, changing their settings to create a network of malicious infrastructure for cyber espionage, starting around May 2025.

Lumen’s Black Lotus Labs has named this extensive hacking campaign FrostArmada. Microsoft describes it as an effort to exploit weak routers typically found in homes and small businesses (SOHO) to take over DNS traffic and passively collect network information.

“They changed DNS settings on hacked routers to redirect local network traffic, allowing them to steal user credentials,” Black Lotus Labs explained in their report.

“When a user tried to access specific websites, the hackers redirected them to a fake ‘man-in-the-middle’ (AitM) server where the entered credentials were stolen. This was a very stealthy attack that didn’t require any action from the user.”

The infrastructure used in this campaign has been shut down as part of a joint effort with the U.S. Department of Justice, the FBI, and international partners.

The activity is believed to have started in May 2025 on a limited scale, followed by widespread router hacking and DNS redirection in early August. By December 2025, over 18,000 unique IP addresses from at least 120 countries were communicating with APT28’s infrastructure.

The main targets were government organizations like foreign ministries, law enforcement agencies, and third-party email and cloud service providers in North Africa, Central America, Southeast Asia, and Europe.

Microsoft’s Threat Intelligence team attributed the campaign to APT28 and a subgroup called Storm-2754. The company reported that over 200 organizations and 5,000 consumer devices were affected by the malicious DNS infrastructure.

“For nation-state actors like Forest Blizzard, hijacking DNS provides continuous and widespread monitoring capabilities,” Microsoft stated. “By compromising devices that are connected to larger targets, hackers can leverage less secure assets to infiltrate corporate networks.”

The DNS hijacking also enabled AitM attacks, allowing the theft of passwords, OAuth tokens, and other credentials for websites and email services, putting organizations at risk of more extensive breaches.

Microsoft noted that this is the first time this group has been seen using DNS hijacking on such a large scale to support AitM attacks on Transport Layer Security (TLS) connections after exploiting edge devices.

The attack works by APT28 remotely accessing SOHO devices and changing the default network settings to use DNS resolvers they control. This causes the devices to send DNS requests to the hacker’s servers.

As a result, DNS lookups for email applications or login pages are resolved by the malicious DNS server. The hackers then attempt to perform AitM attacks on those connections to steal user account credentials by tricking victims into connecting to fake infrastructure.

Some of these domains were related to Microsoft Outlook on the web. Microsoft also said they detected AitM activity targeting non-Microsoft hosted servers in at least three government organizations in Africa.

“The DNS hijacking operations are believed to be opportunistic. The actor identifies a large pool of potential target users and then filters them at each stage to find victims of likely intelligence value,” according to the U.K. National Cyber Security Centre (NCSC).

APT28 reportedly exploited TP-Link WR841N routers for its DNS poisoning, likely using CVE-2023-50224 (CVSS score: 6.5), an authentication bypass vulnerability that could be used to obtain stored credentials through specific HTTP GET requests.

Another cluster of servers was discovered receiving DNS requests through compromised routers and forwarding them to remote servers controlled by the hackers. This cluster is also thought to have been involved in interactive operations against a small number of MikroTik routers in Ukraine.

“Forest Blizzard’s DNS hijacking and AitM activity allows them to collect DNS information on sensitive organizations globally, which aligns with their longstanding mission of gathering intelligence against high-priority targets,” Microsoft explained.

“Although Forest Blizzard has only used their DNS hijacking to gather information, an attacker could use an AiTM position for other purposes, such as installing malware or causing a denial of service.”