Full Report
An international operation from law enforcement authorities in partnership with private companies has disrupted FrostArmada, an APT28 campaign hijacking local traffic from MikroTik and TP-Link routers to steal Microsoft account credentials. [...]
Analysis Summary
# Threat Actor: APT28
## Attribution & Identity
- **Name:** APT28
- **Aliases:** Fancy Bear, Sofacy, Forest Blizzard (Microsoft), Strontium, Storm-2754, Sednit.
- **Known Associations:** Linked to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS), Military Unit 26165.
## Activity Summary
- **Campaign Name:** FrostArmada
- **Timeline:** Active from at least May 2025 through March 2026, with a significant surge in December 2025.
- **Description:** A global operation hijacking Small Office/Home Office (SOHO) routers to perform DNS redirection. The campaign aimed to intercept authentication traffic to steal Microsoft 365 logins and OAuth tokens. At its peak, the campaign infected 18,000 devices across 120 countries.
## Tactics, Techniques & Procedures
- **SOHO Router Exploitation:** Targeting internet-exposed routers via known vulnerabilities or weak configurations.
- **DNS Hijacking:** Altering router DNS settings to point to attacker-controlled VPS resolvers.
- **DHCP Manipulation:** Pushing malicious DNS settings to internal network devices automatically via DHCP.
- **Adversary-in-the-Middle (AitM):** Using proxy services on VPS nodes to intercept "break and inspect" traffic, bypassing traditional security if users ignore TLS certificate warnings.
- **Credential & Token Theft:** Capturing unencrypted data, specifically targeting Microsoft account credentials and valid OAuth tokens.
- **Operational Branching:** Operation split into an "Expansion team" (botnet growth/device compromise) and a "Credential collection team" (AitM/proxy operations).
## Targeting
- **Sectors:** Government agencies, law enforcement, IT and hosting providers, and organizations with on-premise email servers.
- **Geography:** Global (120 countries) with specific focus on North Africa, Central America, Southeast Asia, and a national identity platform in Europe.
- **Victims:** 18,000 devices; specifically three government organizations in Africa and Microsoft 365 / Outlook on the web users.
## Tools & Infrastructure
- **Affected Hardware:**
- MikroTik and TP-Link routers (primary).
- Nethesis firewalls and older Fortinet models.
- **Infrastructure:** Malicious Virtual Private Servers (VPS) used as DNS resolvers and AitM proxies.
- **IOCs (Defanged):**
- 64.120.31[.]96
- 79.141.160[.]78
- 23.106.120[.]119
- 79.141.173[.]211
- 185.117.89[.]32
- 185.237.166[.]55
## Implications
The FrostArmada campaign demonstrates a sophisticated shift toward exploiting the "edge" (SOHO routers) to gain a foothold in corporate and government networks. By hijacking DNS at the hardware level, APT28 effectively bypassed many endpoint-based DNS protections. The scale (18,000 devices) and the use of AitM proxies show a high-volume credential harvesting capability designed to enable follow-on exploitation and long-term espionage.
## Mitigations
- **Certificate Pinning:** Implement certificate pinning via MDM for corporate devices to prevent users from bypassing TLS warnings during AitM attempts.
- **Router Security:**
- Immediately patch internet-exposed routers and firewalls.
- Disable remote management interfaces where not required.
- Replace end-of-life (EoL) equipment that no longer receives security updates.
- **DNS Monitoring:** Monitor for unauthorized changes to router DNS settings or unusual DNS resolution patterns originating from the network perimeter.
- **User Education:** Train staff to recognize and report TLS/SSL certificate warning pop-ups, emphasizing that these should never be bypassed.
- **Zero Trust:** Implement MFA (beyond just tokens which can be stolen) and scrutinize OAuth token usage for anomalies.