An international effort involving law enforcement and private companies has stopped FrostArmada, an APT28 operation that hijacked local traffic from MikroTik and TP-Link routers to steal Microsoft account information.

The Russian threat actor APT28, also known as Fancy Bear, Sofacy, Forest Blizzard, Strontium, Storm-2754, and Sednit, is connected to the GRU’s 85th Main Special Service Center (GTsSS), military unit 26165.

In the FrostArmada attacks, the hackers targeted mainly small office/home office (SOHO) routers and changed the DNS settings to point to VPS servers they controlled; these servers acted as DNS resolvers.

This allowed APT28 to intercept authentication traffic to targeted domains and steal Microsoft logins and OAuth tokens.

At its height in December 2025, FrostArmada had infected 18,000 devices in 120 countries, primarily targeting government agencies, law enforcement, IT and hosting providers, and organizations managing their own servers.

Microsoft, the target of this operation, collaborated with Black Lotus Labs (BLL), Lumen’s threat research division, to track the malicious activity and identify victims.

With assistance from the FBI, the U.S. Department of Justice, and the Polish government, the malicious infrastructure has been shut down.

The attackers targeted routers accessible from the internet, particularly MikroTik and TP-Link, as well as some Nethesis firewalls and older Fortinet models.

Once compromised, the devices communicated with the attackers’ infrastructure and received DNS configuration changes that redirected traffic to malicious VPS nodes.

The new DNS settings were automatically distributed to internal devices via DHCP.

When clients queried authentication-related domains that the threat actor targeted, the DNS server returned the attacker’s IP instead of the legitimate one, directing victims to an adversary-in-the-middle (AitM) proxy.

The only sign of fraud for the victim would have been an invalid TLS certificate warning, which could have easily been ignored. Ignoring the alert, however, gave the threat actor access to the victim’s unencrypted internet communication.

“The actor essentially operated a proxy service as the AitM that the end user was directed to via DNS,” Lumen’s Black Lotus Labs researchers explained.

“The only indication of this attack would be a pop-up warning about connecting to an untrusted source because of the ‘break and inspect’ configuration.”

“If warnings were present and ignored or clicked through, the actor proxied requests to the legitimate services, collecting the data at the midpoint and collecting data associated with the targeted account by passing the valid OAuth token.”

In some cases, though, the hackers faked DNS responses for certain domains, thus forcing affected endpoints to connect to the attack infrastructures, according to a Microsoft report released today.

Lumen reports that FrostArmada operated using two groups, one called the ‘Expansion team’ focused on device compromise and botnet growth, and the other focused on AiTM and credential theft.

The researchers report that FrostArmada activity increased sharply after an August 2025 report from the UK’s National Cyber Security Centre (NCSC) about a Forest Blizzard toolset targeting Microsoft account credentials and tokens.

Microsoft confirmed that APT28 conducted AitM attacks on domains related to Microsoft 365, as subdomains for Microsoft Outlook on the web were also targeted.

The company also saw this activity on servers belonging to three government organizations in Africa that were not hosted on Microsoft infrastructure. In those attacks, “Forest Blizzard intercepted DNS requests and conducted follow-on collection.”

Black Lotus Labs also saw the threat actor targeting entities with on-premise email servers and “a small number of government organizations” in North Africa, Central America, and Southeast Asia.

The researchers note that “there was also a connection to a national identity platform in one European country.”

In a report released today, the UK agency says that the AitM activity impacted both browser sessions and desktop applications, and the DNS hijacking is believed to have been opportunistic in nature to build a large pool of potential targets and then filtering those of interest.

Black Lotus Labs has published a small set of indicators of compromise for the VPS servers used during the FrostArmada campaign.

The researchers suggest that defenders implement certificate pinning for corporate devices (laptops, mobile phones) controlled via an MDM solution, which would generate an error when the attacker tries to intercept and analyze traffic on their VPS infrastructure.

Another recommendation is to reduce the attack surface by patching, limiting exposure on the public web, and removing all end-of-life equipment.

Microsoft and the NCSC also provide a list of IoCs and protection guidance to help defenders identify and prevent DNS hijacking attacks.