# APT28 (GRU Unit 26165) exploits TP-Link and MikroTik routers to enable DNS hijacking and AitM credential theft (CVE-2023-50224) - FrostArmada / Operation Masquerade

> APT28 (Forest Blizzard, GRU Unit 26165) compromised SOHO routers, mainly TP-Link (including WR841N via CVE-2023-50224) and MikroTik, and changed their DHCP/DNS settings to send selected lookups, including Outlook/Office 365 email and login services, to actor-controlled resolvers. The resulting adversary-in-the-middle position was used to harvest passwords and OAuth tokens and to filter victims for intelligence value.

- **Published:** 2026-10-19T10:36:09Z
- **Last reviewed:** 2026-10-19T10:36:09Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3874
- **ID:** TL-2026-3874
- **Severity:** HIGH (CVSS 6.5)
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** APT28 (Russia)
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2023-50224

## Description

The UK NCSC (published 2026-04-07, updated 2026-05-13), Microsoft Threat Intelligence and Lumen Black Lotus Labs (tracking the campaign as FrostArmada) describe a large-scale APT28 campaign against small office/home office (SOHO) routers. The NCSC assesses APT28 as almost certainly the Russian GRU 85th Main Special Service Centre (GTsSS) Military Intelligence Unit 26165. Lumen dates limited activity from May 2025, widespread exploitation from about August 2025 and a peak in December 2025, with more than 18,000 moderate-confidence victim IP addresses in at least 120 countries. Microsoft reports activity since at least August 2025 and attributes it to APT28 and its sub-group Storm-2754, with more than 200 organizations and about 5,000 consumer devices affected. The DOJ's court-authorized Operation Masquerade describes GRU exploitation of known vulnerabilities to steal credentials for thousands of TP-Link routers since at least 2024.

Initial access exploits router vulnerabilities. For TP-Link the NCSC and press reporting cite CVE-2023-50224, an unauthenticated flaw in the httpd service of TL-WR841N and related models. A crafted HTTP GET discloses stored credentials. NVD scores it 6.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and CISA added it to the KEV catalog on 2025-09-03. The NCSC lists affected models: WR841N, WR840N, WR841HP, WR842N, WR842ND, WR845N, WR941ND, WR945N, WR740N, WR740N/WR741ND, WR749N, WR1043ND, WR1045ND, WDR3500, WDR3600, WDR4300, ARCHER C5, ARCHER C7, MR3420, MR6400, WA801ND and WA901ND. With administrative access the actor rewrites the router's DHCP DNS server settings to attacker-controlled IP addresses. Those settings propagate to every downstream client. No malware is named in the sources. Lumen's engineers noted the group used no malware, and that after the August 2025 NCSC disclosure of its earlier malware-based tooling it moved within days to widespread DNS manipulation.

The actor's VPS infrastructure runs the legitimate dnsmasq utility on UDP 53 (banner dnsmasq-2.85) with SSH on TCP 56777 or 35681. For chosen domains, such as autodiscover-s.outlook.com, imap-mail.outlook.com, outlook.live.com, outlook.office.com and outlook.office365.com, the resolvers return fraudulent records pointing to an AitM node. Victims who accept an invalid TLS certificate expose credentials and OAuth/similar tokens, and Krebs reports tokens were intercepted after users completed MFA. Microsoft saw this as its first observation of Forest Blizzard using DNS hijacking at scale to support AiTM of TLS connections after exploiting edge devices. Automated filtering decides which DNS requests merit interception, and the NCSC describes the operation as opportunistic, gaining visibility of a large candidate pool and then filtering users down at each stage. Microsoft also observed non-Microsoft AiTM activity, including against government services in Africa, and post-compromise mailbox access (MailItemsAccessed, Search).

The NCSC splits infrastructure into Cluster One (108 IPs, the compromise and botnet-expansion side) and Cluster Two (32 IPs, which receives DNS requests from likely compromised TP-Link and MikroTik devices and forwards them to further actor-owned servers). Cluster Two was also used for interactive operations against a small number of MikroTik routers, often in Ukraine, judged to be of intelligence value. On 2026-04-07 the DOJ and FBI announced a court-authorized operation that pushed commands to compromised U.S. routers, resetting DNS to ISP-assigned resolvers and revoking the actor's access, and took the U.S. portion of the network offline. Targets include government ministries, law enforcement, foreign affairs bodies, third-party email providers and the IT, telecommunications and energy sectors.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1584.008 Network Devices
- T1583.002 DNS Server
- T1583.003 Virtual Private Server
- T1586 Compromise Accounts
- T1588.006 Vulnerabilities
- T1557 Adversary-in-the-Middle
- T1528 Steal Application Access Token
- T1557 Adversary-in-the-Middle
- T1114 Email Collection

## Sources

- [APT28 exploit routers to enable DNS hijacking operations (UK NCSC)](https://www.ncsc.gov.uk/news/apt28-exploit-routers-to-enable-dns-hijacking-operations)
- [SOHO router compromise leads to DNS hijacking and adversary-in-the-middle attacks (Microsoft)](https://microsoft.com/en-us/security/blog/2026/04/07/soho-router-compromise-leads-to-dns-hijacking-and-adversary-in-the-middle-attacks)
- [Justice Department conducts court-authorized disruption of DNS hijacking network controlled by GRU](https://www.justice.gov/opa/pr/justice-department-conducts-court-authorized-disruption-dns-hijacking-network-controlled)
- [Russian State-Linked APT28 Exploits SOHO Routers in Global DNS Hijacking Campaign (The Hacker News)](https://thehackernews.com/2026/04/russian-state-linked-apt28-exploits.html)
- [Russia Hacked Routers to Steal Microsoft Office Tokens (KrebsOnSecurity)](https://krebsonsecurity.com/2026/04/russia-hacked-routers-to-steal-microsoft-office-tokens/)
- [NVD - CVE-2023-50224](https://nvd.nist.gov/vuln/detail/CVE-2023-50224)
- [CISA Known Exploited Vulnerabilities Catalog (CVE-2023-50224 added 2025-09-03)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [US disrupts Russian espionage operation involving hacked routers and DNS hijacking (SecurityWeek)](https://www.securityweek.com/us-disrupts-russian-espionage-operation-involving-hacked-routers-and-dns-hijacking)
- [Forest Blizzard leverages router compromises to launch AiTM attacks on Outlook sessions (CSO Online)](https://csoonline.com/article/4155632/forest-blizzard-leverages-router-compromises-to-launch-aitm-attacks-target-outlook-sessions.html)
- [NCSC: Protect your management interfaces](https://www.ncsc.gov.uk/blog-post/protect-your-management-interfaces)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3874