Russia's Forest Blizzard Nabs Rafts of Logins via SOHO Routers

A GRU-linked APT28 subgroup has been intercepting web traffic by exploiting old vulnerabilities in SOHO routers (MikroTik, TP-Link and others) to change DNS and route victim requests through attacker-operated VPS, enabling credential theft from email and web services; researchers observed thousands of affected IPs and hundreds of organizations worldwide and the U.S. DOJ executed a disruption called Operation Masquerade.