cyber.hendryadrian.com
Security Report · dti.domaintools.com

Report Details Russian Router Hijacking and Messaging-Account Operations

· Original article ↗

Summary

The report describes Russian-linked operations using compromised routers for DNS hijacking and collection, alongside phishing and account abuse targeting messaging platforms and Microsoft 365. It assesses high-risk targets and recommends router, messaging, and identity-

Key points

  • The report attributes router and edge-device exploitation to GRU Unit 26165, also known as APT28, for DNS manipulation, credential interception, and persistent intelligence collection.
  • Microsoft reportedly assessed the router campaign had been active since at least August 2025, affecting more than 200 organizations and 5,000 consumer devices.
  • The report says Lumen described router exploitation across more than 18,000 IPs in at least 120 countries.
  • Reported router techniques include changing DNS and DHCP settings and redirecting selected users to fraudulent TLS certificates, potentially exposing webmail and cloud traffic.
  • Messaging operations reportedly targeted Signal, WhatsApp, Telegram, and Microsoft 365 through linked-device abuse, QR-code lures, and OAuth phishing.
  • High-priority targets include government and military personnel, critical infrastructure, Ukraine-related organizations, journalists, NGOs, and researchers.
  • Recommended defenses include patching or replacing routers, checking DNS settings, reviewing linked messaging devices, using phishing-resistant MFA, and restricting risky OAuth consent.

Article Details

Publisher
DomainTools
Report Period
2026; router campaign assessed to have run since at least 2025-08
Scope
Russian intelligence-linked router/DNS hijacking and messaging-platform targeting
Key Statistics
  • Microsoft assessed that the router campaign affected more than 200 organizations and 5,000 consumer devices.
  • Lumen described router exploitation across more than 18,000 IPs in at least 120 countries.
  • FBI and CISA warned in March 2026 that Russian-linked actors had compromised thousands of commercial messaging accounts.
  • DOJ said the compromised-router network included thousands of TP-Link devices.
Recommendations
  • Replace end-of-life routers, patch firmware, disable remote administration, rotate router administrator credentials, verify DNS settings, and monitor for unexpected resolvers.
  • Regularly review linked devices in Signal, WhatsApp, and Telegram; remove unknown sessions and enable registration locks or PINs where available.
  • Treat QR codes, group invites, security alerts, and video-call setup links received from sensitive contacts as high risk.
  • Harden Microsoft 365 against OAuth and device-code phishing by enforcing phishing-resistant MFA, restricting risky OAuth consent flows, monitoring anomalous device joins, and training high-risk personnel not to share authentication codes.

MITRE ATT&CK

T1016 · System Network Configuration DiscoveryThe report maps observation of network and resolver configurations to System Network Configuration Discovery.T1046 · Network Service DiscoveryThe report maps reconnaissance through DNS visibility to Network Service Discovery.T1056 · Input CaptureThe report maps credential interception via redirected authentication flows to Input Capture.T1071 · Application Layer ProtocolThe report maps DNS- and HTTPS-based communications to Application Layer Protocol.T1078 · Valid AccountsThe report maps abuse of compromised messaging and cloud accounts to Valid Accounts.T1090 · ProxyThe report maps DNS and adversary-in-the-middle proxy routing to Proxy.T1098 · Account ManipulationThe report maps addition of linked devices to Signal accounts to Account Manipulation.T1113 · Screen CaptureThe report lists potential follow-on account monitoring under Screen Capture.T1114 · Email CollectionThe report maps interception of Outlook Web Access traffic to Email Collection.T1123 · Audio CaptureThe report lists potential collection through compromised communication workflows under Audio Capture.T1133 · External Remote ServicesThe report maps continued access through compromised cloud identities to External Remote Services.T1190 · Exploit Public-Facing ApplicationThe report maps exploitation of vulnerable SOHO and TP-Link routers to Exploit Public-Facing Application.T1204 · User ExecutionThe report maps victim interaction with QR codes and phishing links to User Execution.T1213 · Data from Information RepositoriesThe report maps access to cloud-hosted communications to Data from Information Repositories.T1498 · Network Denial of ServiceThe report describes Network Denial of Service as a potential latent capability through router control.T1530 · Data from Cloud StorageThe report maps Microsoft 365 and cloud-message access to Data from Cloud Storage.T1548 · Abuse Elevation Control MechanismThe report maps router administrative compromise and configuration manipulation to Abuse Elevation Control Mechanism.T1555 · Credentials from Password StoresThe report maps interception of stored or synced credentials to Credentials from Password Stores.T1556 · Modify Authentication ProcessThe report maps OAuth workflow abuse and session persistence to Modify Authentication Process.T1557 · Adversary-in-the-MiddleThe report maps TLS interception and DNS redirection to Adversary-in-the-Middle.T1562 · Impair DefensesThe report maps operating outside enterprise EDR visibility to Impair Defenses.T1566 · PhishingThe report maps messaging-app phishing and OAuth lure delivery to Phishing.T1566.002 · Spearphishing LinkThe report maps malicious OAuth/device-code URL delivery to Spearphishing Link.T1567 · Exfiltration Over Web ServiceThe report maps cloud-account data access and exfiltration to Exfiltration Over Web Service.T1568 · Dynamic ResolutionThe report maps actor-controlled DNS infrastructure to Dynamic Resolution.T1573 · Encrypted ChannelThe report maps TLS/HTTPS transport to Encrypted Channel.T1574 · Hijack Execution FlowThe report maps DNS response manipulation and traffic redirection to Hijack Execution Flow.T1589 · Gather Victim Identity InformationThe report maps collection of contact lists and identity relationships to Gather Victim Identity Information.T1590 · Gather Victim Network InformationThe report maps DNS and routing visibility collection to Gather Victim Network Information.T1649 · Steal or Forge Authentication CertificatesThe report maps use of fraudulent or invalid TLS certificates to Steal or Forge Authentication Certificates.

Threat Actors

APT28Name used for the Russian GRU's Unit 26165, which the report also identifies as Fancy Bear and Forest Blizzard.Fancy BearName used for the Russian GRU's Unit 26165, which the report also identifies as APT28 and Forest Blizzard.Star BlizzardThe report says Microsoft observed Star Blizzard move into WhatsApp lures.Unit 26165Russian GRU unit attributed the router and DNS hijacking activity; the report identifies it as also known as APT28, Fancy Bear, and Forest Blizzard.

Products

Microsoft 365without putting malware on the machine. Their work against Signal, WhatsApp, Telegram, and Microsoft 365 gives them the other half: messages, contacts, trusted names, and private conversations. Together, itOutlook Web Accessand used false DNS records to stage adversary-in-the-middle attacks against services such as Outlook Web Access.Signalsteer chosen victims, and steal credentials without putting malware on the machine. Their work against Signal, WhatsApp, Telegram, and Microsoft 365 gives them the other half: messages, contacts, trusted names, andTelegramand steal credentials without putting malware on the machine. Their work against Signal, WhatsApp, Telegram, and Microsoft 365 gives them the other half: messages, contacts, trusted names, and privateTP-LinkDOJ said the network relied on compromised SOHO routers, including thousands of TP-Link devices. The actors stole credentials, filtered DNS requests, and used false DNS records to stage adversary-in-the-middle attacksWhatsAppchosen victims, and steal credentials without putting malware on the machine. Their work against Signal, WhatsApp, Telegram, and Microsoft 365 gives them the other half: messages, contacts, trusted names, and private

Countries

RussiaRussia is increasingly treating edge infrastructure and messaging platforms as persistent intelligence-collection terrain. Router compromise provides GRU-linked operators with a passive upstream vantage point overUkrainecollection against government, defense, critical infrastructure, diplomatic, media, NGO, and Ukraine-related targets.

Industries

Critical infrastructurethese operations support long-term intelligence collection against government, defense, critical infrastructure, diplomatic, media, NGO, and Ukraine-related targets.Defenseplatforms. Together, these operations support long-term intelligence collection against government, defense, critical infrastructure, diplomatic, media, NGO, and Ukraine-related targets.EnergyThe threat is highest for government, defense, critical infrastructure, telecom, energy, Ukraine-support organizations, journalists, NGOs, policy researchers, and other targets of likely intelligence value. TheseGovernmentmessaging platforms. Together, these operations support long-term intelligence collection against government, defense, critical infrastructure, diplomatic, media, NGO, and Ukraine-related targets.Medialong-term intelligence collection against government, defense, critical infrastructure, diplomatic, media, NGO, and Ukraine-related targets.Non-governmental organizationsTelecommunications

Related Articles