# Forest Blizzard (Russian GRU Unit 26165) SOHO Router DNS-Hijacking Campaign Enables AitM Credential Theft Against Outlook Web Access — Operation Masquerade

> Forest Blizzard (APT28/Fancy Bear, Russian GRU 85th GTsSS Military Unit 26165) compromised thousands of small office/home office (SOHO) routers — chiefly end-of-life TP-Link TL-WR841N devices via CVE-2023-50224 and secondarily MikroTik routers — rewriting DHCP/DNS settings so victim traffic is silently redirected through actor-controlled dnsmasq resolvers into adversary-in-the-middle infrastructure that presents spoofed TLS certificates to harvest Microsoft Outlook Web Access credentials, session cookies, and MFA tokens. Microsoft telemetry logged 200+ organizations and 5,000+ consumer devices affected, peaking at 18,000+ hijacked routers across 120+ countries in December 2025; on 2026-04-07 the FBI, DOJ, NSA and a 23-agency international coalition publicly disclosed and remediated the U.S. footprint of the botnet under the court-authorized 'Operation Masquerade.'

- **Published:** 2026-07-18T00:00:00Z
- **Last reviewed:** 2026-07-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1497
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-operation-masquerade-apt28-router-hijack-tl-2026-1497.webp?v=e3900f3f (Threadlinqs threat intel: APT28 Masquerade SOHO DNS Hijack: Detection & IOCs (TL-2026-1497) — High severity, 16 IOCs, 9 detection rules.)
- **ID:** TL-2026-1497
- **Severity:** HIGH (CVSS 6.5)
- **Category:** ESPIONAGE
- **Status:** ACTIVE
- **Actor:** APT28 (Russia)
- **Detections:** 9 (1 shown free below) · **IOCs:** 16
- **CVEs:** CVE-2023-50224

## Description

Forest Blizzard — Microsoft's designation for the GRU 85th Main Special Service Center (GTsSS) Military Unit 26165 actor more widely known as APT28, Fancy Bear, Sofacy, and Sednit — has run a large-scale espionage campaign that abandons phishing-link delivery in favor of network-level adversary-in-the-middle (AitM) interception staged from compromised consumer and small-office routers.

The actor, operating a sub-cluster tracked as Storm-2754, obtained unauthorized access to SOHO routers beginning at least 2024 (per FBI/IC3), scaling into large-volume operations from August 2025 onward (per Microsoft telemetry). Initial access to the primary target set — end-of-life TP-Link TL-WR841N routers — was achieved via CVE-2023-50224, an unauthenticated improper-authentication vulnerability in the device's httpd/TDDP service that discloses stored Dropbear SSH credentials from /tmp/dropbear/dropbearpwd over plain HTTP GET requests. Where routers still used vendor-default or weak administrative credentials, GRU operators also brute-forced or reused leaked default logins to gain admin access directly. A secondary MikroTik router cluster was used for more interactive, hands-on-keyboard operations, notably against Ukraine-adjacent infrastructure.

Once inside a router's administrative interface, the actor modified DHCP-issued DNS server settings (DHCP spoofing) so that every LAN client silently resolves DNS through an actor-controlled resolver rather than the ISP's or a public resolver. The hijacked resolvers ran the open-source dnsmasq utility listening on TCP/UDP port 53, allowing the actor to answer queries for specific high-value domains (predominantly outlook.office.com and related Microsoft 365 authentication endpoints) with attacker-controlled IP addresses while passing all other DNS traffic through unmodified — minimizing victim-visible disruption and evading casual detection.

Traffic to the spoofed domains was routed to AitM relay infrastructure that terminated the client's TLS session with an invalid/self-signed certificate masquerading as the legitimate Microsoft service, then proxied credentials, session cookies, and OAuth/MFA tokens through to the real service to keep the session alive while capturing the authentication material server-side. Victims who dismissed browser or mail-client certificate warnings had their plaintext traffic — including email content — exposed to the actor for the duration of the session. Microsoft specifically observed non-Microsoft-hosted government mail servers in at least three African countries targeted through this same DNS-hijack-to-AitM chain, indicating the technique generalizes beyond Microsoft 365 to any TLS service the actor chooses to spoof.

Campaign scale peaked in December 2025 with more than 18,000 uniquely hijacked routers spanning at least 120 countries feeding DNS query telemetry and credential material to GRU-controlled infrastructure, organized as two server clusters: one performing DNS interception at the edge and a second forwarding harvested material and interactive-access traffic to further actor-owned infrastructure. Victim sectors skewed toward government (including foreign-affairs ministries and law enforcement), telecommunications, energy, and IT/cloud-email providers, with reported concentration in North Africa, and additional victims in Central America, Southeast Asia, and Europe; over 23 U.S. states had affected TP-Link devices.

On 2026-04-07, the FBI (led by FBI Boston), DOJ, NSA, and 23 partner agencies (including Canada, Czech Republic, Denmark, Estonia, Finland, Germany, and Italy) publicly attributed the campaign to GRU Military Unit 26165 and executed a court-authorized remediation operation ('Operation Masquerade') that sent commands to compromised routers in the United States to collect evidence, reset hijacked DNS settings, and block the GRU's original access mechanism, without altering the routers' legitimate functionality (reversible by the owner via factory reset). Truesec's 2026-07-16 report indicates the underlying TTP — router compromise leading to DNS-based AitM credential harvesting — remains an active, ongoing GRU capability against unprotected SOHO devices outside the remediated U.S. footprint.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1590 Gather Victim Network Information
- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078 Valid Accounts
- T1601 Modify System Image
- T1036 Masquerading
- T1599 Network Boundary Bridging
- T1110 Brute Force
- T1557 Adversary-in-the-Middle
- T1111 Multi-Factor Authentication Interception
- T1606 Forge Web Credentials
- T1016 System Network Configuration Discovery
- T1557 Adversary-in-the-Middle
- T1114 Email Collection
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TLS Certificate Validation Failure to Outlook/M365 Followed by Continued Authentication** (`TL-2026-1497-SPL-003`)

Detects a browser or mail-client TLS certificate validation failure/warning for an Outlook Web Access or Microsoft 365 domain followed by continued authentication traffic to the same host, indicating the victim dismissed the AiTM relay's spoofed-certificate warning and completed a credential/session-cookie exchange with the actor's relay infrastructure.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1557, T1606.001, T1111
- **Data sources:** windows_event_log, browser_certificate_logs, SigninLogs, DeviceEvents
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=application sourcetype="WinEventLog:Application" (Application="chrome.exe" OR Application="msedge.exe" OR Application="outlook.exe")
| search Message="*certificate*" Message="*outlook.office.com*" OR Message="*login.microsoftonline.com*"
| eval risk_desc="Cert warning for M365 domain, check for continued auth traffic within 5m"
| stats count min(_time) as first_seen max(_time) as last_seen by ComputerName, Application, Message
| sort - last_seen
```

### Microsoft KQL

```kql
let LookbackWindow = 24h;
let CertWarnings = DeviceEvents
| where Timestamp > ago(LookbackWindow)
| where ActionType == "TlsCertificateValidationFailed"
| where AdditionalFields has_any ("outlook.office.com", "login.microsoftonline.com")
| project WarnTime = Timestamp, DeviceName, AccountName;
let AuthEvents = SigninLogs
| where TimeGenerated > ago(LookbackWindow)
| where ResultType == 0
| project AuthTime = TimeGenerated, UserPrincipalName, IPAddress;
CertWarnings
| join kind=inner (AuthEvents) on $left.AccountName == $right.UserPrincipalName
| where AuthTime between (WarnTime .. WarnTime + 5m)
| project WarnTime, AuthTime, DeviceName, AccountName, IPAddress
```

### Sigma

```yaml
title: TLS Certificate Validation Failure Followed by Continued Session to Microsoft 365 Endpoint
id: 7b1e2c40-1497-4f01-9a10-a1c2d3e4f507
status: experimental
description: Detects a browser/mail-client TLS certificate warning for an Outlook/Microsoft 365 domain followed by continued authentication activity, consistent with AiTM certificate-warning bypass and credential/token relay
references:
    - https://www.microsoft.com/en-us/security/blog/2026/04/07/soho-router-compromise-leads-to-dns-hijacking-and-adversary-in-the-middle-attacks/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-18
tags:
    - attack.credential-access
    - attack.t1557
    - attack.t1606.001
    - attack.t1111
logsource:
    category: application
    product: windows
detection:
    selection_warning:
        EventID: 1000
        Application|contains:
            - 'chrome.exe'
            - 'msedge.exe'
            - 'outlook.exe'
        Message|contains: 'certificate'
    selection_target:
        Message|contains:
            - 'outlook.office.com'
            - 'login.microsoftonline.com'
    condition: selection_warning and selection_target
falsepositives:
    - Internal TLS-inspecting proxy/CASB presenting a re-signed certificate that legitimately triggers a warning for a small subset of clients
level: high
```

**Known false positives:**

- Internal TLS-inspecting proxy or CASB presenting a re-signed certificate that legitimately triggers a warning

**Tuning notes:** Exclude hosts behind a known corporate TLS-inspection proxy by device group; correlate cert-warning and follow-on auth events within a tight (5-minute) window to reduce false correlation.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SOHO Router Admin Access via Weak/Default Credentials or CVE-2023-50224 (locked: unlock with TL Creds)
- Rogue dnsmasq Process Bound to Port 53 on Non-Designated DNS Host (locked: unlock with TL Creds)
- Sustained Outbound DNS Volume to Single Non-ISP Non-Enterprise Resolver (locked: unlock with TL Creds)
- Router Firmware/TDDP Exploitation Chain Leading to Credential Exposure (locked: unlock with TL Creds)
- Selective DNS Response Spoofing for High-Value Domain (locked: unlock with TL Creds)
- MFA/Session-Token Reuse Shortly After Certificate-Warning Event (AiTM Token Relay) (locked: unlock with TL Creds)
- CVE-2023-50224 TP-Link TDDP/httpd dropbearpwd Credential Disclosure GET (locked: unlock with TL Creds)
- DHCP-Issued DNS Server Drift to Unapproved / Non-ISP Resolver (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Russian Intelligence Targets SOHO Routers](https://www.truesec.com/hub/blog/russian-intelligence-targets-soho-routers)
- [Russian Espionage Campaign Targets Home Routers](https://www.truesec.com/hub/blog/russian-espionage-campaign-targets-home-routers)
- [SOHO router compromise leads to DNS hijacking and adversary-in-the-middle attacks](https://www.microsoft.com/en-us/security/blog/2026/04/07/soho-router-compromise-leads-to-dns-hijacking-and-adversary-in-the-middle-attacks/)
- [Forest Blizzard leverages router compromises to launch AiTM attacks, target Outlook sessions](https://www.csoonline.com/article/4155632/forest-blizzard-leverages-router-compromises-to-launch-aitm-attacks-target-outlook-sessions.html)
- [Russian State-Linked APT28 Exploits SOHO Routers in Global DNS Hijacking Campaign](https://thehackernews.com/2026/04/russian-state-linked-apt28-exploits.html)
- [Russia's Forest Blizzard Nabs Rafts of Logins via SOHO Routers](https://www.darkreading.com/threat-intelligence/russia-forest-blizzard-logins-soho-routers)
- [US operation evicts Russia from hacked SOHO routers used to breach critical infrastructure](https://www.cybersecuritydive.com/news/russia-routers-hacking-dns-fbi-disruption/816960/)
- [Justice Department Conducts Court-Authorized Disruption of DNS Hijacking Network Controlled by a Russian Military Intelligence Unit](https://www.justice.gov/opa/pr/justice-department-conducts-court-authorized-disruption-dns-hijacking-network-controlled)
- [Russian GRU Exploiting Vulnerable Routers to Steal Sensitive Information (IC3 PSA I-040726-PSA)](https://www.ic3.gov/PSA/2026/PSA260407)
- [APT28, Forest Blizzard — MITRE ATT&CK Group G0007](https://attack.mitre.org/groups/G0007/)
- [CVE-2023-50224 Detail](https://nvd.nist.gov/vuln/detail/cve-2023-50224)
- [Security Advisory for CVE-2023-50224 – Impact on Legacy TP-Link Router and Access Point Products](https://www.tp-link.com/us/support/faq/5058/)
- [CVE-2023-50224: TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure](https://github.com/advisories/GHSA-g654-hw9f-49w6)
- [CISA Flags TP-Link Router Flaws CVE-2023-50224 and CVE-2025-9377 as Actively Exploited](https://thehackernews.com/2025/09/cisa-flags-tp-link-router-flaws-cve.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1497