What happened
A Russia-linked threat group known as APT28 (also called Fancy Bear or Forest Blizzard) has been compromising consumer-grade routers from MikroTik and TP-Link, modifying their DNS settings, and using them to intercept Microsoft 365 credentials. The campaign, codenamed FrostArmada, has been running since at least May 2025 and has affected thousands of devices globally.
An international law enforcement operation, working alongside private sector partners, has now disrupted the campaign's infrastructure. But the underlying vulnerabilities that made it possible remain widespread.
How the attack works
The technique is straightforward and effective. APT28 exploited insecure small office/home office (SOHO) routers, many running default credentials or unpatched firmware. Once compromised, the routers' DNS settings were silently changed to point to attacker-controlled servers.
From there, traffic from anyone on that network could be redirected. Users attempting to reach Microsoft 365 login pages were served convincing phishing pages instead. Passwords and authentication tokens were harvested at scale, feeding a broader cyber espionage operation.
This is not a novel technique. DNS hijacking has been around for years. What makes FrostArmada notable is the scale, the state-level actor behind it, and the specific targeting of Microsoft 365 credentials, which remain a high-value target for espionage and lateral movement.
Why this matters for organisations
Many businesses still rely on consumer-grade or lightly managed routers at branch offices, home offices, and remote sites. These devices sit outside the visibility of most security programmes. They are rarely patched, often use default credentials, and are not covered by endpoint detection tools.
The shift to hybrid work has made this worse. Employees authenticating to Microsoft 365 from home networks are trusting infrastructure that their IT teams have no control over. A compromised home router can silently redirect authentication traffic without triggering any alerts on the corporate side.
This campaign also highlights the continued importance of Microsoft 365 as a target. It is the primary productivity platform for most organisations, and a compromised account can provide access to email, SharePoint, Teams, and OneDrive, often without further exploitation.
What organisations should consider
- Enforce phishing-resistant MFA. FIDO2 security keys and passkeys are resistant to credential interception because authentication is bound to the legitimate domain. Token-based phishing pages cannot replicate this. Time-based one-time passwords (TOTP) and SMS codes offer less protection in this scenario.
- Deploy conditional access policies. Microsoft Entra ID conditional access can restrict logins based on device compliance, location, and risk signals. These controls reduce the value of stolen credentials even if interception occurs.
- Monitor for suspicious sign-in activity. Microsoft 365 provides sign-in logs and risk detections. Look for impossible travel, unfamiliar locations, and token replay activity. These signals can indicate credential theft even when the phishing itself happens outside your network.
- Manage SOHO routers where possible. For remote workers, consider providing managed routers or issuing configuration guidance that covers firmware updates, changing default credentials, and disabling remote management. DNS-over-HTTPS (DoH) on endpoints can also mitigate DNS hijacking at the router level.
- Use a trusted DNS resolver on endpoints. Configuring laptops and mobile devices to use a known secure DNS resolver, rather than relying on whatever the local router provides, adds a practical layer of defence against this type of attack.
Metaphor's perspective
This campaign is a reminder that identity security does not stop at the application layer. The network path between a user and their login page matters, and threat actors are increasingly targeting the weakest links in that path.
At Metaphor, we help organisations harden their Microsoft 365 environments with conditional access, phishing-resistant authentication, and continuous monitoring. We also work with clients to assess the security of their remote work infrastructure, including the overlooked devices that sit between users and the cloud.
If you are unsure whether your Microsoft 365 tenant is configured to withstand credential interception attacks like FrostArmada, we can help you find out.
Sources: The Hacker News, BleepingComputer, TechCrunch