What is Forest Blizzard and who runs it?

Forest Blizzard (aka APT28, Fancy Bear) is Russia's GRU military intel unit, behind DNC hacks and election meddling.

How do I check if my router was hacked by Russian actors?

Scan DNS settings for unknown servers (e.g., not your ISP's). Tools like routerlogs.com or Shodan query your public IP.

Can DNS hijacking steal my Microsoft account without passwords?

Yes — it grabs post-MFA OAuth tokens, letting hackers impersonate you in Office apps.

GRU's Simple Router Trick Nabbed Microsoft Tokens from 18,000 Networks

Over 18,000 routers — mostly dusty old Mikrotik and TP-Link models — got flipped by Russian military hackers last year. They didn't drop malware; just tweaked DNS to swipe Microsoft auth tokens mid-session.

Threat Digest Apr 07, 2026 3 min read

Network diagram showing Russian hackers rerouting DNS on compromised routers to intercept Microsoft tokens

⚡ Key Takeaways

GRU's Forest Blizzard hijacked 18K routers via DNS flaws to steal MS Office tokens, no malware needed. 𝕏
Targets: 200 orgs + 5K devices, focusing on gov agencies and SOHO gear. 𝕏
Old-school tactic scales fast; patch EOL routers or risk AiTM account takeovers. 𝕏

Published by

Threat Digest

Threat intelligence. Zero noise.

#APT28 #DNS hijacking #Forest Blizzard #GRU hackers #Russian GRU #Russian GRU hackers

Worth sharing?

Get the best Cybersecurity stories of the week in your inbox — no noise, no spam.

Originally reported by Krebs on Security

⚡ Key Takeaways

The 60-Second TL;DR

Threat Digest

Share this article

Worth sharing?

Related Stories

APT28's FrostArmada: How Russian Spies Hijacked 18,000 Routers for Stealthy Global Espionage

APT28's Router Trap: How Russian Hackers Are Siphoning Your Secrets Through Everyday WiFi Gear

FrostArmada's Fall: How Cops Crushed Russia's Router Spy Network Targeting Microsoft Logins

Iran's Hackers Already Sabotaging US Power and Water Grids

Stay in the loop