TLDR Tech / InfoSec
Russian Forest Blizzard Hackers Hijack Home Routers for Global Spying
Microsoft Threat Intelligence has linked Forest Blizzard (Fancy Bear) and sub-group Storm-2754 to a SOHO router hijacking campaign active since August 2025, compromising 5,000+ devices across 200 organizations to conduct DNS hijacking and AiTM attacks at scale using dnsmasq for persistent traffic redirection. Targeted sectors include energy, IT, and telecom, with confirmed data interception from three African government organizations and a specific focus on Microsoft Outlook web users. Microsoft recommends enforcing MFA, adopting passwordless authentication, and prohibiting the use of basic home routers for corporate access to reduce remote workforce exposure.
Read the full story