APT28 Disrupts Router DNS to Steal Microsoft Credentials in Global Campaign

APT28 (linked to the GRU) conducted the FrostArmada campaign that hijacked DNS settings on vulnerable MikroTik and TP‑Link routers—exploiting CVE-2023-50224—to perform adversary-in-the-middle attacks and harvest Microsoft credentials from approximately 18,000 devices across 120 countries, primarily targeting government and IT sectors; the infrastructure was disrupted by an international operation supported by Microsoft, the FBI and other agencies, and the UK NCSC warned organizations to secure routers.