cyber.hendryadrian.com
Security News · bleepingcomputer.com

Authorities Disrupt APT28-Linked FrostArmada Router DNS Hijacking Campaign

· Original article ↗

Summary

Authorities, Microsoft, and Lumen disrupted infrastructure for FrostArmada, an APT28-linked campaign that hijacked SOHO routers to redirect DNS traffic and steal Microsoft credentials and OAuth tokens.

Key points

  • The FBI, U.S. Department of Justice, Polish authorities, Microsoft, and Lumen helped map the activity and take the malicious infrastructure offline.
  • The campaign compromised mainly MikroTik and TP-Link SOHO routers, as well as some Nethesis and older Fortinet devices, and changed DNS settings distributed through DHCP.
  • Malicious DNS responses redirected authentication traffic to adversary-in-the-middle proxies that could capture Microsoft logins and OAuth tokens.
  • Black Lotus Labs reported that the campaign reached 18,000 devices across 120 countries at its peak in December 2025.
  • Targets included government agencies, law enforcement, IT and hosting providers, and organizations with their own servers.
  • Recommended defenses include certificate pinning on managed devices, patching exposed routers, and removing end-of-life equipment.

Article Details

Event Type
International law enforcement operation disrupted infrastructure used in the FrostArmada DNS-hijacking campaign.
Impact
The campaign compromised SOHO routers and some firewall devices, redirecting authentication traffic through adversary-in-the-middle proxies to steal Microsoft logins and OAuth tokens. At its peak in December 2025, it reportedly infected 18,000 devices across 120 countries. The offending infrastructure was taken offline.

Indicators of compromise

TypeIndicatorContext
IPV4185[.]117[.]89[.]32VPS IP address identified by Black Lotus Labs as infrastructure used in the FrostArmada campaign.
IPV4185[.]237[.]166[.]55VPS IP address identified by Black Lotus Labs as infrastructure used in the FrostArmada campaign.
IPV423[.]106[.]120[.]119VPS IP address identified by Black Lotus Labs as infrastructure used in the FrostArmada campaign.
IPV464[.]120[.]31[.]96VPS IP address identified by Black Lotus Labs as infrastructure used in the FrostArmada campaign.
IPV479[.]141[.]160[.]78VPS IP address identified by Black Lotus Labs as infrastructure used in the FrostArmada campaign.
IPV479[.]141[.]173[.]211VPS IP address identified by Black Lotus Labs as infrastructure used in the FrostArmada campaign.

MITRE ATT&CK

T1557 · Adversary-in-the-MiddleThe attackers used adversary-in-the-middle proxies to intercept authentication traffic and collect Microsoft logins and OAuth tokens.

Threat Actors

APT28The article attributes the FrostArmada DNS-hijacking and adversary-in-the-middle activity to APT28.Fancy BearThe article identifies Fancy Bear as another name for APT28, which it links to the FrostArmada DNS-hijacking campaign.SednitThe article identifies Sednit as another name used for APT28, which it links to the FrostArmada DNS-hijacking campaign.Storm-2754The article identifies Storm-2754 as another name used for APT28, which it links to the FrostArmada DNS-hijacking campaign.STRONTIUMThe article identifies Strontium as another name for APT28, which it links to the FrostArmada DNS-hijacking campaign.

Vendors

FortinetAttackers compromised MikroTik and TP‑Link SOHO routers (and some Nethesis and older Fortinet devices) to push malicious DNS via DHCP.Lumen TechnologiesMicrosoft and Lumen’s Black Lotus Labs mapped the activity and, with the FBI, the U.S.Microsoftan APT28 campaign that hijacked MikroTik and TP‑Link SOHO routers to redirect DNS traffic and steal Microsoft account credentials and OAuth tokens.MikroTiklaw enforcement operation with private partners disrupted FrostArmada, an APT28 campaign that hijacked MikroTik and TP‑Link SOHO routers to redirect DNS traffic and steal Microsoft account credentials and OAuthNethesisAttackers compromised MikroTik and TP‑Link SOHO routers (and some Nethesis and older Fortinet devices) to push malicious DNS via DHCP.TP-Linkprivate companies has disrupted FrostArmada, an APT28 campaign hijacking local traffic from MikroTik and TP-Link routers to steal Microsoft account credentials.

Products

Microsoft 365 Apps for EnterpriseMicrosoft confirmed that APT28 carried out AitM attacks against domains associated with the Microsoft 365 service, as subdomains for Microsoft Outlook on the web have also been targeted.Microsoft Outlook on the webMicrosoft confirmed that APT28 carried out AitM attacks against domains associated with the Microsoft 365 service, as subdomains for Microsoft Outlook on the web have also been targeted.

Countries

RussiaAPT28 (aka Fancy Bear, Strontium, Forest Blizzard) is linked to Russia’s GRU unit 26165.United StatesMicrosoft and Lumen’s Black Lotus Labs mapped the activity and, with the FBI, the U.S.

Industries

GovernmentAt its peak in December 2025, FrostArmada infected 18,000 devices across 120 countries, primarily targeting government agencies, law enforcement, IT and hosting providers, and organizations operating their own servers.hostingAt its peak in December 2025, FrostArmada infected 18,000 devices across 120 countries, primarily targeting government agencies, law enforcement, IT and hosting providers, and organizations operating their own servers.Law enforcementAn international law enforcement operation with private partners disrupted FrostArmada, an APT28 campaign that hijacked MikroTik and TP‑Link SOHO routers to redirect DNS traffic and steal Microsoft account credentials

Related Articles