Russia Hacked Routers to Steal Microsoft Office Tokens
Summary: Hackers tied to Russia's GRU military intelligence, tracked as Forest Blizzard or APT28, modified DNS settings on mostly unsupported or end-of-life Mikrotik and TP-Link routers to intercept OAuth authentication tokens from Microsoft Office users, reaching more than 18,000 routers at peak activity in December 2025. Microsoft identified over 200 organizations and 5,000 consumer devices caught in the campaign, which targeted government agencies including ministries of foreign affairs and law enforcement, and required no malware on the routers themselves.
Why it matters: Because the stolen tokens are transmitted after login and multi-factor authentication, the attackers gained account access without phishing a single credential or one-time code - and Black Lotus Labs noted the group switched to mass DNS alteration the day after an August 2025 NCSC report, targeting everything vulnerable.
Read the original at Krebs on Security ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026