Russian State-Linked APT28 Exploits SOHO Routers in Global DNS Hijacking Campaign Russia-linked APT28 (aka Forest Blizzard) conducted a campaign codenamed FrostArmada that compromised insecure MikroTik and TP‑Link SOHO routers to change DNS settings and hijack local network traffic for passive collection and AiTM credential theft. Active since May 2025 and peaking in December with communications from over 18,000 IPs across 120 countries,...

Russian-linked APT28 exploited insecure MikroTik and TP-Link SOHO routers in a global DNS hijacking campaign dubbed FrostArmada, targeting 120 countries and stealing credentials via AiTM attacks. #Russia #DNSHijack #RouterExploit