cyber.hendryadrian.com
Security News · thecyberexpress.com

Forest Blizzard Used Compromised SOHO Routers for DNS Hijacking and AiTM Attacks

· Original article ↗

Summary

Forest Blizzard reportedly compromised SOHO routers to redirect DNS queries, affecting more than 200 organizations and 5,000 consumer devices. The campaign enabled monitoring and targeted AiTM attacks; Microsoft said its own systems were not compromised.

Key points

  • Researchers say Forest Blizzard targeted vulnerable SOHO routers from at least August 2025, changing their DNS settings to use attacker-controlled resolvers.
  • Compromised routers distributed malicious DNS settings to connected devices through DHCP; the group reportedly used dnsmasq to handle and monitor DNS queries.
  • Microsoft identified more than 200 organizations and over 5,000 consumer devices affected by the DNS infrastructure, but reported no compromise of Microsoft-owned systems.
  • The campaign included targeted AiTM activity against Microsoft 365, particularly Outlook on the web, and government servers in at least three African countries.
  • In some cases, attackers redirected users to malicious infrastructure and presented invalid TLS certificates; users who ignored warnings could expose session data.
  • Recommended defenses include DNS logging and blocking, Zero Trust DNS, MFA, Conditional Access, passwordless authentication, and Microsoft Defender for Endpoint protections.

Article Details

Event Type
Campaign attributed to Forest Blizzard involving compromised SOHO routers, DNS hijacking, and adversary-in-the-middle attacks.
Impact
Microsoft identified more than 200 organizations and over 5,000 consumer devices affected by the malicious DNS infrastructure; its telemetry showed no compromise of Microsoft-owned systems. The campaign enabled passive monitoring and targeted interception of traffic, including attacks involving Microsoft 365 and government servers in at least three African countries. The article says intercepted data could include emails and other sensitive content when users ignored invalid TLS certificate warnings.

MITRE ATT&CK

T1557 · Adversary-in-the-MiddleThe article describes adversary-in-the-middle attacks using spoofed DNS responses to redirect victims and intercept communications.

Threat Actors

APT28The article attributes the SOHO router compromise and DNS hijacking campaign to Forest Blizzard, described as associated with Russian military intelligence.Storm-2754The article identifies Storm-2754 as a tracking name associated in part with Forest Blizzard.

Vendors

Microsoftdnsmasq) and conducting adversary-in-the-middle attacks against services like Outlook on the web and Microsoft 365, the group can monitor and intercept sensitive traffic across thousands of consumer and

Products

Microsoft 365 Apps for Enterprisednsmasq) and conducting adversary-in-the-middle attacks against services like Outlook on the web and Microsoft 365, the group can monitor and intercept sensitive traffic across thousands of consumer and organizationalMicrosoft Defender for EndpointRecommended mitigations include Zero Trust DNS, DNS logging and blocking, MFA and passwordless authentication, Conditional Access, and enabling Microsoft Defender for Endpoint protections.Outlook on the websettings (often using dnsmasq) and conducting adversary-in-the-middle attacks against services like Outlook on the web and Microsoft 365, the group can monitor and intercept sensitive traffic across thousands of

Countries

RussiaThe rise of SOHO router compromise campaigns, led by the Russia-linked threat actor Forest Blizzard, has turned poorly secured home and small-office devices into covert infrastructure for DNS hijacking and large-scale

Industries

GovernmentOperations include passive monitoring and targeted AiTM attacks against Microsoft 365 (Outlook on the web) and government servers in multiple African countries.

Related Articles