Threat reportAPTTL-2026-3874
APT28 (GRU Unit 26165) exploits TP-Link and MikroTik routers to enable DNS hijacking and AitM credential theft (CVE-2023-50224) - FrostArmada / Operation Masquerade
APT28 (GRU Unit 26165) exploits TP-Link and MikroTik routers (TL-2026-3874), also tracked as FrostArmada, is a high-severity advanced persistent threat campaign scored CVSS 6.5, first published 2026-10-19. It is attributed to APT28 (Russia) with high confidence, affects TP-Link TL-WR841N and related SOHO routers/access points (WR840N, references 1 CVE (CVE-2023-50224), maps to 9 MITRE ATT&CK techniques (T1114, T1190, T1528), and is covered by 9 detection rules and 23 indicators of compromise.
- CVSS
- 6.5/10High
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 9MITRE ATT&CK
- Actors
- 1APT28
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 23Indicators of compromise
Key facts for TL-2026-3874
- Threat ID
- TL-2026-3874
- Also known as
- FrostArmada, Operation Masquerade
- Severity
- HIGH
- CVSS
- 6.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution
- APT28
- Attribution confidence
- HIGH
- Nation-state nexus
- Russia
- Motivation
- ESPIONAGE
- Target sectors
- government administration, police - law enforcement, foreign-affairs, it, telecoms, energy, email-providers, military
- Target regions
- North Africa, 013 - Central America, Southeast Asia, Europe, North America, afghanistan, ukraine
- Detection rules
- 9
- Indicators of compromise
- 23
Malware and tooling in APT28 (GRU Unit 26165) exploits TP-Link and MikroTik routers
Malware and tooling: SOURFACE, dnsmasq
How APT28 (GRU Unit 26165) exploits TP-Link and MikroTik routers works
APT28 (Forest Blizzard, GRU Unit 26165) compromised SOHO routers, mainly TP-Link (including WR841N via CVE-2023-50224) and MikroTik, and changed their DHCP/DNS settings to send selected lookups, including Outlook/Office 365 email and login services, to actor-controlled resolvers. The resulting adversary-in-the-middle position was used to harvest passwords and OAuth tokens and to filter victims for intelligence value.
The UK NCSC (published 2026-04-07, updated 2026-05-13), Microsoft Threat Intelligence and Lumen Black Lotus Labs (tracking the campaign as FrostArmada) describe a large-scale APT28 campaign against small office/home office (SOHO) routers. The NCSC assesses APT28 as almost certainly the Russian GRU 85th Main Special Service Centre (GTsSS) Military Intelligence Unit 26165. Lumen dates limited activity from May 2025, widespread exploitation from about August 2025 and a peak in December 2025, with more than 18,000 moderate-confidence victim IP addresses in at least 120 countries. Microsoft reports activity since at least August 2025 and attributes it to APT28 and its sub-group Storm-2754, with more than 200 organizations and about 5,000 consumer devices affected. The DOJ's court-authorized Operation Masquerade describes GRU exploitation of known vulnerabilities to steal credentials for thousands of TP-Link routers since at least 2024.
Initial access exploits router vulnerabilities. For TP-Link the NCSC and press reporting cite CVE-2023-50224, an unauthenticated flaw in the httpd service of TL-WR841N and related models. A crafted HTTP GET discloses stored credentials. NVD scores it 6.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and CISA added it to the KEV catalog on 2025-09-03. The NCSC lists affected models: WR841N, WR840N, WR841HP, WR842N, WR842ND, WR845N, WR941ND, WR945N, WR740N, WR740N/WR741ND, WR749N, WR1043ND, WR1045ND, WDR3500, WDR3600, WDR4300, ARCHER C5, ARCHER C7, MR3420, MR6400, WA801ND and WA901ND. With administrative access the actor rewrites the router's DHCP DNS server settings to attacker-controlled IP addresses. Those settings propagate to every downstream client. No malware is named in the sources. Lumen's engineers noted the group used no malware, and that after the August 2025 NCSC disclosure of its earlier malware-based tooling it moved within days to widespread DNS manipulation.
The actor's VPS infrastructure runs the legitimate dnsmasq utility on UDP 53 (banner dnsmasq-2.85) with SSH on TCP 56777 or 35681. For chosen domains, such as autodiscover-s.outlook.com, imap-mail.outlook.com, outlook.live.com, outlook.office.com and outlook.office365.com, the resolvers return fraudulent records pointing to an AitM node. Victims who accept an invalid TLS certificate expose credentials and OAuth/similar tokens, and Krebs reports tokens were intercepted after users completed MFA. Microsoft saw this as its first observation of Forest Blizzard using DNS hijacking at scale to support AiTM of TLS connections after exploiting edge devices. Automated filtering decides which DNS requests merit interception, and the NCSC describes the operation as opportunistic, gaining visibility of a large candidate pool and then filtering users down at each stage. Microsoft also observed non-Microsoft AiTM activity, including against government services in Africa, and post-compromise mailbox access (MailItemsAccessed, Search).
The NCSC splits infrastructure into Cluster One (108 IPs, the compromise and botnet-expansion side) and Cluster Two (32 IPs, which receives DNS requests from likely compromised TP-Link and MikroTik devices and forwards them to further actor-owned servers). Cluster Two was also used for interactive operations against a small number of MikroTik routers, often in Ukraine, judged to be of intelligence value. On 2026-04-07 the DOJ and FBI announced a court-authorized operation that pushed commands to compromised U.S. routers, resetting DNS to ISP-assigned resolvers and revoking the actor's access, and took the U.S. portion of the network offline. Targets include government ministries, law enforcement, foreign affairs bodies, third-party email providers and the IT, telecommunications and energy sectors.
MITRE ATT&CK techniques used in TL-2026-3874
Collection
T1114 Email Collection; T1557 Adversary-in-the-Middle
Initial Access
T1190 Exploit Public-Facing Application
Credential Access
T1528 Steal Application Access Token; T1557 Adversary-in-the-Middle
Resource Development
T1583.002 DNS Server; T1583.003 Virtual Private Server; T1584.008 Network Devices; T1586 Compromise Accounts; T1588.006 Vulnerabilities
Affected products and versions in APT28 (GRU Unit 26165) exploits TP-Link and MikroTik routers
- TP-Link — TL-WR841N and related SOHO routers/access points (WR840N, WR841HP, WR842N, WR845N, WR941ND, WR945N, WR740N, WR749N, WR1043ND, WR1045ND, WDR3500, WDR3600, WDR4300, Archer C5, Archer C7, MR3420, MR6400, WA801ND, WA901ND)
Vulnerable versions: TL-WR841N V8-V12 prior to fixed firmware
Fixed in: TL-WR841N V11_211209; TL-WR841N V12_230317 - MikroTik — RouterOS SOHO routers (Cluster Two traffic; interactive operations against devices in Ukraine)
Vulnerable versions: Unspecified in sources
Remediation for APT28 (GRU Unit 26165) exploits TP-Link and MikroTik routers
Patches
- Apply TP-Link firmware fixing CVE-2023-50224 (for example TL-WR841N V11_211209 and V12_230317)
- Update MikroTik RouterOS to current releases
Immediate actions
- Do not expose router management interfaces to the internet and restrict them to trusted internal networks
- Audit SOHO and branch routers for DHCP/DNS settings pointing to unknown resolvers and reset them to ISP or corporate resolvers
- Hunt DNS, firewall and proxy logs for traffic to the Cluster One and Cluster Two IP ranges and to dnsmasq-2.85 banner hosts
- Review Entra ID / Microsoft 365 sign-ins for risky sign-ins, MailItemsAccessed and Search activity, and revoke suspect OAuth tokens and sessions
Workarounds
- Replace end-of-life TP-Link models for which no fixed firmware exists
- Disable remote administration and unneeded services on SOHO routers
Longer-term hardening
- Enforce MFA and phishing-resistant authentication with continuous access evaluation
- Replace end-of-life SOHO routers and avoid SOHO routers in corporate environments
- Enable security monitoring and logging, application allowlisting and host-based intrusion detection
- Enforce DNS protections on endpoints (encrypted/validated DNS, network and web protection) and train staff to reject invalid TLS certificate warnings
CVEs associated with APT28 (GRU Unit 26165) exploits TP-Link and MikroTik routers
Weaknesses (CWE) in APT28 (GRU Unit 26165) exploits TP-Link and MikroTik routers
Timeline of APT28 (GRU Unit 26165) exploits TP-Link and MikroTik routers
- CVE-2023-50224 (TP-Link TL-WR841N credential disclosure via crafted HTTP GET) published in NVD with CVSS 6.5.
- Lumen Black Lotus Labs observes the first limited-capacity router compromise and DNS hijacking activity (FrostArmada), from May 2025.
- Widespread exploitation begins from about August 2025. Lumen reports APT28 abandoned malware-based tooling for DNS manipulation within days of an NCSC disclosure.
- CISA adds CVE-2023-50224 to the Known Exploited Vulnerabilities catalog with a 2025-09-24 remediation deadline.
- Peak of the campaign: more than 18,000 unique victim IP addresses in at least 120 countries under actor influence.
- DOJ and FBI announce court-authorized Operation Masquerade, resetting DNS settings on compromised U.S. routers and taking the U.S. portion of the network offline.
- UK NCSC, Microsoft and Lumen publish findings attributing the router DNS hijacking campaign to APT28 / GRU Unit 26165.
- NCSC advisory page last modified with the Cluster One and Cluster Two infrastructure indicators.
Sources cited for APT28 (GRU Unit 26165) exploits TP-Link and MikroTik routers
- APT28 exploit routers to enable DNS hijacking operations (UK NCSC)
- SOHO router compromise leads to DNS hijacking and adversary-in-the-middle attacks (Microsoft)
- Justice Department conducts court-authorized disruption of DNS hijacking network controlled by GRU
- Russian State-Linked APT28 Exploits SOHO Routers in Global DNS Hijacking Campaign (The Hacker News)
- Russia Hacked Routers to Steal Microsoft Office Tokens (KrebsOnSecurity)
- NVD - CVE-2023-50224
- CISA Known Exploited Vulnerabilities Catalog (CVE-2023-50224 added 2025-09-03)
- US disrupts Russian espionage operation involving hacked routers and DNS hijacking (SecurityWeek)
- Forest Blizzard leverages router compromises to launch AiTM attacks on Outlook sessions (CSO Online)
- NCSC: Protect your management interfaces
Detection coverage for TL-2026-3874
As of 2026-10-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3874 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.