Forest Blizzard Used Compromised SOHO Routers for DNS Hijacking and TLS AiTM Attacks
Summary
Microsoft reports that Forest Blizzard and Storm-2754 compromised SOHO routers to hijack DNS and selectively conduct TLS AiTM attacks. The activity affected over 200 organizations and 5,000 consumer devices; Microsoft also shared detection and mitigation guidance.
Key points
- Microsoft observed more than 200 organizations and 5,000 consumer devices affected by the activity; its telemetry did not indicate compromise of Microsoft-owned assets or services.
- Forest Blizzard altered compromised SOHO devices’ DNS settings to send queries to actor-controlled resolvers, enabling passive observation of network traffic.
- Microsoft assesses that the actor is almost certainly using dnsmasq for DNS resolution and query handling on port 53.
- In some cases, the actor spoofed DNS responses for targeted domains and presented invalid TLS certificates; if users ignored certificate warnings, the actor could intercept plaintext traffic.
- Microsoft observed selective follow-on AiTM activity targeting Microsoft Outlook on the web domains and servers at at least three government organizations in Africa.
- Microsoft recommends addressing vulnerable SOHO devices and DNS changes, enforcing MFA and Conditional Access, and using identity monitoring and Defender detection and hunting guidance.
Article Details
- Attack Vectors
- Compromise of vulnerable SOHO routers, followed by changes to their DNS settings to direct queries to actor-controlled resolvers.
- DNS hijacking used to passively collect DNS traffic and conduct reconnaissance.
- In some compromises, spoofed DNS responses redirected targeted endpoints to actor-controlled infrastructure.
- Selective TLS adversary-in-the-middle attacks used invalid certificates impersonating legitimate services; if users ignored certificate warnings, the actor could intercept plaintext traffic.
- The article says credential theft and further activity as a valid user were possible outcomes of AiTM activity.
- Defensive Notes
- Secure SOHO devices and address vulnerable or compromised routers; reset DNS settings when malicious changes are identified.
- Monitor for unusual DNS-setting modifications on connected devices.
- Centralize identity management and logging, and use Conditional Access with strictly enforced multifactor authentication, especially for privileged and high-risk accounts.
- Use continuous access evaluation and sign-in risk policies; consider passwordless authentication such as passkeys.
- Review risky sign-in and risky user reports, and investigate unusual Search or MailItemsAccessed activity in Microsoft 365 environments.
MITRE ATT&CK
T1040 · Network SniffingThe compromised SOHO devices and DNS infrastructure enabled passive collection of DNS traffic; AiTM activity also enabled interception of traffic within TLS connections when users ignored invalid-certificate warnings.T1557 · Adversary-in-the-MiddleForest Blizzard conducted TLS adversary-in-the-middle attacks and, in some compromises, used spoofed DNS responses to redirect endpoints to actor-controlled infrastructure.T1584.008 · Network DevicesForest Blizzard compromised SOHO network devices and used them in activity that directed DNS queries to actor-controlled resolvers.
Threat Actors
APT28Microsoft attributes the large-scale compromise of SOHO devices, DNS hijacking, and selective TLS AiTM activity to Forest Blizzard. The article describes the actor as Russian-aligned and says it primarily collects intelligence in support of Russian government foreign policy initiatives.Storm-2754Microsoft identifies Storm-2754 as a sub-group of Forest Blizzard and tracks it as the component associated with this activity.
Vendors
Products
Microsoft 365 Apps for EnterpriseAiTM attack against Microsoft 365 domains: Microsoft observed Forest Blizzard conducting follow-on AiTM operations against a subset of domains associated with Microsoft Outlook on the web.Microsoft Defender Antimalware Platformand protection recommendations to reduce exposure from compromised SOHO devices, as well as Microsoft Defender detection and hunting guidance to help defenders identify and investigate related maliciousMicrosoft Defender for Cloud AppsDefender XDR portal can provide some information on user search activities, including the Microsoft Defender for Cloud Apps connector that surfaces activity unusual for that user.Microsoft Defender XDRDefenders can surface highly suspicious or successful risky sign-ins using the following advanced hunting query in the Microsoft Defender XDR portal:Microsoft Entra ID ProtectionThe following Microsoft Entra ID Protection risk detection informs Entra ID user risk events and can indicate associated threat activity, including unusual user activity consistent with known Forest Blizzard attackMicrosoft Security CopilotMicrosoft Security Copilot is embedded in Microsoft Defender and provides security teams with AI-powered capabilities to summarize incidents, analyze files and scripts, summarize identities, use guided responses, andOutlook on the webattacks—spoofing TLS certificates—to intercept traffic for high-value targets, including Microsoft Outlook on the web domains and specific government servers.
Tools
Industries
Energy200 organizations and 5,000 consumer devices across sectors like government, IT, telecommunications, and energy, and Microsoft provides mitigation, detection, and hunting guidance to reduce exposure and investigateGovernmentThe activity impacted over 200 organizations and 5,000 consumer devices across sectors like government, IT, telecommunications, and energy, and Microsoft provides mitigation, detection, and hunting guidance to reduceInformation TechnologyThis activity enables the interception of cloud-hosted content, impacting numerous sectors including government, information technology (IT), telecommunications, and energy—all usual targets for this actor.Telecommunicationsimpacted over 200 organizations and 5,000 consumer devices across sectors like government, IT, telecommunications, and energy, and Microsoft provides mitigation, detection, and hunting guidance to reduce exposure