APT28 Hijacks Routers to Steal Credentials in Global Cyber Espionage Campaign

APT28 (Russian state-sponsored) conducted the FrostArmada campaign by exploiting CVE-2023-50224 in MikroTik and TP-Link consumer/SOHO routers to hijack DNS settings and redirect traffic, enabling adversary-in-the-middle attacks to steal login credentials and authentication tokens from over 18,000 devices in 120 countries; UK NCSC and Microsoft collaborated to disrupt the operation and issued mitigation guidance.