Russian Hackers Exploiting Home and Small-office Routers in Massive DNS hijacking Attack

Microsoft observed Forest Blizzard (APT28/Strontium) conducting a widespread campaign since at least August 2025 that compromises poorly secured SOHO/home routers to replace DNS resolvers with actor-controlled servers, enabling passive DNS collection at scale and selective TLS Adversary-in-the-Middle interceptions—impacting over 200 organizations and more than 5,000 consumer devices and targeting sectors including government, IT, telecommunications, and energy; Microsoft provides mitigations such as updating router firmware, changing default credentials, auditing DNS settings, enforcing VPNs, and training users not to bypass TLS certificate warnings.