#RouterExploit
Russian-linked APT28 exploited insecure MikroTik and TP-Link SOHO routers in a global DNS hijacking campaign dubbed FrostArmada, targeting 120 countries and stealing credentials via AiTM attacks. #Russia #DNSHijack #RouterExploit
Russian State-Linked APT28 Exploits SOHO Routers in Global DNS Hijacking Campaign
Russia-linked APT28 (aka Forest Blizzard) conducted a campaign codenamed FrostArmada that compromised insecure MikroTik and TP‑Link SOHO routers to change DNS settings and hijack local network traffic for passive collection and AiTM credential theft. Active since May 2025 and peaking in December with communications from over 18,000 IPs across 120 countries,...
www.hendryadrian.com
April 8, 2026 at 1:30 AM