How Russian State Hackers Exploit Aging Routers to Hijack Microsoft Authentication Tokens

Introduction: A Stealthy Token Theft Campaign

Security researchers have uncovered a sophisticated espionage campaign by Russian state-backed hackers that targets outdated internet routers to silently siphon authentication tokens from Microsoft Office users. The operation, attributed to the notorious Forest Blizzard group (also known as APT28 or Fancy Bear), has compromised over 18,000 routers across more than 200 organizations and 5,000 consumer devices, according to Microsoft's latest blog post and a new report from Black Lotus Labs, the security division of internet backbone provider Lumen.

The Attack Method: DNS Hijacking Without Malware

The hackers, linked to Russia's General Staff Main Intelligence Directorate (GRU), exploited known vulnerabilities in older, unsupported routers—primarily Mikrotik and TP-Link devices popular in small office/home office (SOHO) setups. Unlike many cyberattacks, this campaign required no malicious software installation on the routers themselves. Instead, the attackers modified the devices' DNS settings to redirect traffic through servers they controlled.

What is DNS Hijacking?

The Domain Name System (DNS) is the internet's phonebook, translating familiar website names into IP addresses. In a DNS hijacking attack, bad actors intercept this process to steer users to fraudulent sites designed to steal credentials or other sensitive data. As the UK's National Cyber Security Centre (NCSC) explains in a new advisory, by compromising routers at the network edge, Forest Blizzard could propagate malicious DNS settings to every device on the local network.

Once the routers were reconfigured to use DNS servers hosted on a handful of virtual private servers controlled by the attackers, any OAuth authentication tokens transmitted by users could be intercepted. These tokens act as digital keys, allowing access to services like Microsoft Office without repeated logins—making them a high-value target.

The Scale and Targets of the Campaign

At its peak in December 2025, Forest Blizzard's surveillance network ensnared over 18,000 internet routers, the majority of which were end-of-life or far behind on security updates. Black Lotus Labs reports that the hackers primarily targeted government agencies, including ministries of foreign affairs, law enforcement bodies, and third-party email providers. The campaign allowed the GRU-linked group to quietly harvest authentication tokens from users across these networks without deploying any malicious code.

Who Was Affected?

Microsoft identified more than 200 organizations and 5,000 consumer devices caught in the spying web. The operation's stealthy nature—using only DNS modifications—made it particularly difficult to detect. Security engineer Ryan English of Black Lotus Labs noted that the attackers' approach was "remarkably simple but remarkably effective."

Historical Context: The GRU's Cyber Operations

Forest Blizzard, also known as APT28 and Fancy Bear, is attributed to the military intelligence units within Russia's GRU. The group gained notoriety in 2016 for compromising the Hillary Clinton campaign, the Democratic National Committee (DNC), and the Democratic Congressional Campaign Committee (DCCC) to interfere with the US presidential election. This latest campaign demonstrates a shift in tactics—from using sophisticated malware to exploiting widely available router vulnerabilities for large-scale token theft.

How to Protect Against Similar Attacks

Organizations and individuals can take several steps to defend against DNS hijacking and token theft:

• Update router firmware: Regularly check for and apply security patches, especially for end-of-life devices. Replace unsupported routers with newer models.
• Change default passwords: Many routers come with easily guessable credentials. Use strong, unique passwords for router administration.
• Monitor DNS settings: Routinely verify that DNS servers are set to trusted providers (e.g., those of your ISP or reputable public DNS services like Cloudflare or Google).
• Enable multi-factor authentication (MFA): Even if tokens are stolen, MFA adds an extra layer of security to accounts.
• Use network segmentation: Separate critical systems from IoT and guest networks to limit the spread of compromised DNS settings.

Conclusion

The Forest Blizzard campaign underscores the growing threat of router-based attacks that require no malware and leave few traces. By exploiting outdated hardware and the ubiquity of DNS, Russian state hackers have created a low-cost, high-impact espionage tool. As Microsoft and Lumen continue to investigate, the incident serves as a stark reminder to prioritize network hygiene and replace aging equipment. For more details, refer to the NCSC advisory on Russian cyber actors and Microsoft's blog post.