FrostArmada: How APT28 Turned Old Home Routers Into a Microsoft 365 Interception Network

On 7 April 2026, the US Department of Justice, the FBI, the UK's National Cyber Security Centre and Microsoft published coordinated reporting on a campaign by APT28, the Russian military intelligence (GRU) unit also tracked as Fancy Bear and Forest Blizzard. Lumen's Black Lotus Labs, which had been tracking the infrastructure, named it FrostArmada.

The technique is almost boring. APT28 broke into old, internet-exposed home and small-office routers and changed the DNS server they hand out to every device on the network. From that position it could quietly watch which domains people looked up and, for the targets it cared about, send their Microsoft 365 logins through its own proxy.

No exploit ran on the victims' computers. No malicious attachment was opened. And because the proxy relayed the real login page, the victims completed MFA themselves.

At a glance

• Actor: APT28 / Forest Blizzard (Russia, GRU unit 26165). Microsoft tracks the router activity under a sub-cluster, Storm-2754.
• Campaign name: FrostArmada (Lumen Black Lotus Labs)
• Active since: at least August 2025, per Microsoft; peak in December 2025
• Scale: more than 18,000 routers at peak (Black Lotus Labs); 200+ organisations and around 5,000 consumer devices affected by the malicious DNS infrastructure (Microsoft)
• Devices: mostly older and end-of-life TP-Link and MikroTik SOHO routers, plus some other edge devices
• Technique: DNS hijacking via changed router settings, then selective adversary-in-the-middle (AitM) on TLS connections to Outlook on the web
• Targets of interest: foreign ministries, law enforcement, third-party email and hosting providers; three government organisations in Africa had their own (non-Microsoft) servers targeted
• Response: court-authorised FBI operation to reset the DNS settings on compromised routers in the US; IoCs published by the NCSC and Black Lotus Labs

One setting, every device

A home or small-office router does two jobs most people never think about. It hands out network settings to every phone and laptop that connects (DHCP), and it tells them which server to ask when they need to turn a name like outlook.office.com into an IP address (DNS).

APT28 abused known weaknesses in neglected routers to get admin access, then changed the DHCP settings so the primary DNS server pointed at a virtual private server the attackers controlled. According to BleepingComputer's reporting on the advisories, the legitimate resolver was kept as the secondary. Nothing visibly broke. Pages still loaded. Every device that joined the network simply inherited the attacker's resolver.

What a hijacked router can look like

Microsoft says the actor almost certainly ran dnsmasq on its infrastructure, answering DNS queries on port 53. For the vast majority of lookups, it just passed the real answer back. That matters: an attacker who only lies occasionally is much harder to notice than one who breaks things.

According to Black Lotus Labs, this was a change in approach. Until an NCSC report in August 2025, Forest Blizzard used malware on a small set of routers. The day after that report, it switched to mass DNS manipulation across vulnerable devices. Changing a configuration value leaves far less behind than an implant does.

Who got the bad answer

Owning the DNS of 18,000 routers gave APT28 a giant passive sensor. It could see which networks were looking up which domains, and use that to pick out the ones worth attacking. BleepingComputer describes the operation as split in two: an "expansion" team compromising devices and growing the pool, and a second team handling interception and credential collection.

When a query came from a network of interest and asked for a targeted domain, mostly Outlook on the web and related Microsoft sign-in hosts, the resolver answered with the IP address of an attacker-controlled proxy instead. In a smaller number of cases the attackers spoofed responses for non-Microsoft government mail servers in Africa.

How a changed DNS setting becomes a stolen session

Why MFA didn't save anyone

This is an adversary-in-the-middle attack, the same family as the phishing kits that relay a real login page. The proxy sits between the user and Microsoft:

1. The user's browser connects to what it thinks is Outlook, but it reaches the proxy.
2. The user signs in and approves the MFA prompt.
3. The proxy forwards everything to the real Microsoft service, which happily completes the login.
4. The session that comes back passes through the proxy, which can read the traffic and capture the session token.

Because session tokens are issued after MFA, whoever holds one can use the account without ever knowing the password or the one-time code. Push notifications, SMS codes and authenticator apps all get relayed just as easily.

There was one tripwire. Microsoft says the proxy presented an invalid TLS certificate impersonating the Microsoft service. Browsers warned. The attack only worked when users clicked through that warning, which tells you something uncomfortable about how often people do. The NCSC noted that the interception affected desktop applications as well as browsers.

Microsoft says it saw no compromise of its own services. This was never a Microsoft vulnerability. It was a router problem that turned into an identity problem.

Why routers keep showing up in these stories

This is not the first time APT28 has lived on consumer hardware. The FBI took down a GRU botnet of compromised Ubiquiti EdgeRouters in early 2024, and SOHO routers keep appearing in Chinese and Russian operations alike. They are attractive for the same reasons every time:

• Nobody watches them. There is no EDR on a home router, and very few companies log what their staff's home networks are doing.
• They don't get patched. Krebs on Security notes that most FrostArmada devices were older, end-of-life models that were unsupported or far behind on updates.
• They sit in front of everything. Remote work put corporate laptops behind consumer equipment. Whoever controls that box controls what the laptop can see.
• They provide cover. Traffic from a residential IP looks like a normal user, not an attacker's server.

The campaign's targets also tell you why a GRU unit bothers. Foreign ministries, police and the email providers that serve them are classic intelligence collection. A minister's adviser working from home on an old ISP router was always going to be the soft spot.

What to do

1. For anyone with a router at home or in a small office

• Log in to the admin page and check the DNS servers under DHCP/LAN settings. If you don't recognise them and they aren't your ISP's, that is a problem. A factory reset removes the changes.
• Update the firmware. If the router no longer gets updates, replace it.
• Change the default admin password and turn off remote management from the internet.

2. For organisations with remote staff

• Don't trust the network the laptop is on. Use encrypted DNS to a resolver you control (DoH/DoT), or Windows' Zero Trust DNS where it's available, so a home router can't silently change where names resolve.
• Move high-value accounts to phishing-resistant MFA, passkeys or FIDO2 keys. These bind the login to the real domain, so a proxy can't relay them. This is the control that actually breaks AitM.
• Use Conditional Access to require compliant devices and shorten session lifetimes. Turn on Continuous Access Evaluation and sign-in risk policies.
• Train people on one specific thing: a certificate warning on a login page means stop, not "click advanced and continue."

3. Hunt

Microsoft published hunting queries. This one surfaces high-risk sign-ins that succeeded or were interrupted by an MFA prompt:

AADSignInEventsBeta
| where RiskLevelAggregated == 100 and (ErrorCode == 0 or ErrorCode == 50140)
| project Timestamp, Application, LogonType, AccountDisplayName, UserAgent, IPAddress

For any account that comes back, check mailbox activity (MailItemsAccessed and search events) and look for sign-ins from IPs or locations the user can't explain. Also check the published NCSC and Black Lotus Labs indicators against your DNS and proxy logs.

On managed endpoints, a change to the DNS resolver itself is worth alerting on. A starting point, to adapt to your own EDR or log schema:

title:  Endpoint resolving through an unexpected DNS server
logic:  endpoint network/dns telemetry
        WHERE dns_server_ip NOT IN <corporate_resolvers + known_isp_ranges>
          AND device IS managed
level:  medium
note:   Raise to high if followed by a Microsoft 365 sign-in
        flagged as risky within 24 hours.

The takeaway

FrostArmada is a reminder that the most effective attacks often don't need anything clever. APT28 took a setting that every router has, on devices that nobody was maintaining, and used it to pick off government email accounts protected by MFA.

The fixes are just as unglamorous: replace end-of-life routers, stop trusting whatever DNS the local network hands out, and move the accounts that matter to passkeys. And if a login page ever throws a certificate warning, close the tab.

This article reflects public information as of 14 April 2026.

Sources

• Microsoft Threat Intelligence: SOHO router compromise leads to DNS hijacking and adversary-in-the-middle attacks
• Krebs on Security: Russia hacked routers to steal Microsoft Office tokens
• BleepingComputer: Authorities disrupt DNS hijacks used to steal Microsoft 365 logins
• CSO Online: Forest Blizzard leverages router compromises to launch AitM attacks targeting Outlook sessions
• ThaiCERT: Forest Blizzard hackers use routers as a platform for cyber espionage