APT28 FrostArmada: The SOHO Router Is the New Invisible…

The GRU compromised 18,000 home routers to steal Microsoft 365 credentials without deploying malware. No EDR can detect this attack: the perimeter has shifted.

On April 7, 2026, the UK National Cyber Security Centre, with support from the FBI and the U.S. Department of Justice, disclosed Operation Masquerade: a disruption operation against a network of SOHO routers compromised by APT28, also known as Fancy Bear, Forest Blizzard, or Storm-2754. The campaign, dubbed FrostArmada by Black Lotus Labs (Lumen Technologies) researchers, exploited the home network as a vector for state-sponsored espionage, intercepting credentials and OAuth tokens of Microsoft 365 users through a mechanism that leaves no trace on corporate endpoints.

The scale is significant: over 18,000 unique IP addresses, distributed across at least 120 countries, communicated with the malicious infrastructure at its peak in December 2025. Microsoft identified more than 200 organizations and approximately 5,000 consumer devices among those impacted. The targets: government agencies, foreign ministries, law enforcement, and cloud service providers in North Africa, Central America, Southeast Asia, and Europe.

Key Takeaways

APT28 compromised SOHO routers globally by modifying DNS/DHCP configurations to redirect traffic to malicious resolvers, without installing malware on victim devices.
The only visible signal to the user was an invalid TLS certificate warning, easily ignored or masked.
Microsoft classified this as the first documented case of large-scale DNS hijacking by APT28 to support Man-in-the-Middle attacks on TLS connections.

The Mechanism: Why the Router Became Invisible to Enterprise Security

The initial vector was the exploitation of TP-Link WR841N routers, presumably via CVE-2023-50224. The official National Vulnerability Database record assigns this vulnerability a CVSS 3.0 score of 6.5, with vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N: adjacent network attack, low complexity, no privileges required, no user interaction, high confidentiality impact, no integrity or availability impact. In short: local access to the Wi-Fi or wired network is sufficient to bypass authentication and gain administrative privileges.

From this position, APT28 modified the router's DHCP and DNS configurations to point local network clients to malicious DNS servers hosted on VPS infrastructure. According to the Department of Justice, the operators then implemented an automated filtering process to determine which DNS requests warranted interception. When a user requested domains of intelligence interest — particularly Microsoft Outlook Web Access — traffic was redirected to attacker-in-the-middle (AitM) nodes where credentials and OAuth tokens were harvested and exfiltrated.

Black Lotus Labs described the technique precisely: "Their technique modified DNS settings on compromised routers to hijack local network traffic to capture and exfiltrate authentication credentials". And further: "When targeted domains were requested by a user, the actor redirected traffic to an attacker-in-the-middle (AitM) node, where those credentials were harvested and exfiltrated. This approach enabled a nearly invisible attack that required no interaction from the end user".

The Operational Novelty: Passive Espionage Without Endpoint Persistence

The fact that rewrites the defensive paradigm is the absence of malware on victim endpoints. The attack requires no workstation compromise, no implant installation, and no operating system persistence. The entire chain occurs upstream: in the home network device the user relies on to connect to the corporate cloud. No EDR installed on a corporate laptop can observe a DHCP modification in a home router. No organizational perimeter firewall intercepts TLS traffic that appears legitimate until the certificate.

Microsoft Threat Intelligence underscored the strategic value of this approach: "For nation-state actors like Forest Blizzard, DNS hijacking enables persistent, passive visibility and reconnaissance at scale". The same source highlighted that this is "the first time the adversary collective has been observed using large-scale DNS hijacking to support AitM of Transport Layer Security connections after exploiting edge devices". Persistence resides in the router, not the endpoint. Collection is passive, not active. The end user takes no action to be compromised.

"Forest Blizzard's DNS hijacking and AitM activity allows the actor to conduct DNS collection on sensitive organizations worldwide and is consistent with the actor's longstanding remit to collect espionage against priority intelligence targets" — Microsoft Threat Intelligence

Timeline and Scale: From Limited Activity to Global Campaign in Seven Months

FrostArmada activity began in limited form in May 2025, with a significant escalation in August 2025 and a peak in December 2025. The growth curve suggests operational iteration: initial testing on narrow targets, refinement of automated DNS filtering, geographic expansion. The primary targets confirm a classic intelligence profile: foreign ministries, government agencies, law enforcement. The presence of third-party email and cloud providers in the crosshairs indicates a possible interest in indirect access to sensitive communication chains.

Microsoft clarified that no proprietary Microsoft asset or service was compromised: collection occurred on the client side, during user interaction with legitimate services. The DoJ added that users can remove any residual modifications by performing a factory reset of the router. The FBI, under court authorization, conducted a technical operation to reset DNS to legitimate resolvers in the U.S. portion of the network while simultaneously gathering investigative evidence.

Areas of uncertainty remain. Converging sources ICT Security Magazine and The Hacker News exercise caution in linking CVE-2023-50224 to the exploit: presumably for the former, likely for the latter. The NVD record confirms the TP-Link WR841N vulnerability but does not establish a definitive forensic nexus with the campaign. The Department of Justice did not quantify the exact number of credentials actually stolen, nor has Microsoft disclosed the identity of the 200+ impacted organizations. It also remains unclear whether the MikroTik routers in Ukraine mentioned by The Hacker News are part of FrostArmada or a separate operational cluster.

Immediate Actions

Operational recommendations derive directly from the mechanisms documented in the brief and from official source statements:

Verify router configuration integrity: The DoJ indicated factory reset as the method to eliminate residual DNS/DHCP modifications. Organizations with remote workforces should extend security inventory to home network devices used for work access.
Monitor outbound DNS: The entire FrostArmada mechanism depends on resolver redirection. Systematic verification of DNS servers configured on endpoints and routers detects anomalies before interception occurs.
Enforce MFA and train on TLS warnings: The OAuth token can be stolen, but MFA adds friction. The only visible signal of the attack is the invalid certificate warning: user training on this specific indicator is the only endpoint defense line.
Recalibrate the security perimeter: The campaign demonstrates that the enterprise security supply chain must explicitly include consumer edge devices. The "zero trust" paradigm that stops at the cloud leaves a gap between the provider and the employee's couch.

Why This Changes the Threat Model

The editorial assessment is clear: FrostArmada is not an isolated case but the operational proof of a theoretical hypothesis discussed for years. Enterprise security has invested heavily in EDR, XDR, CASB, cloud SIEM: all tools that assume the endpoint device or SaaS service as the unit of analysis. The SOHO router remained outside the conceptual perimeter, managed by the user, updated sporadically, never inventoried. APT28 exploited precisely this institutional void.

The mechanism is particularly effective because it requires no zero-day vulnerability: CVE-2023-50224 is a known bug, with a medium CVSS, in obsolete consumer hardware. The GRU's operational investment was in the scalability of malicious DNS infrastructure and intelligent filtering, not in sophisticated exploit development. Microsoft added a cautionary note: the acquired AitM position could in the future be exploited for DoS or malware deployment, expanding the threat spectrum beyond current passive collection.

The "dead perimeter" paradigm now requires a corollary: the perimeter has shifted into home network devices, invisible to traditional security, and these are the new battlefield for state-sponsored espionage.

Information verified against cited sources and current as of publication.

Sources

Sources and references