Russian Forest Blizzard Hackers Hijack Home Routers for Global Spying

Microsoft Threat Intelligence reports that the APT group Forest Blizzard (aka Fancy Bear) and sub-group Storm-2754 have been compromising over 5,000 home and small-office routers and 200 organisations using DNS hijacking (via dnsmasq) to create persistent, passive surveillance infrastructure and conduct Adversary-in-the-Middle attacks—targeting Outlook web users and sectors such as energy, IT, and telecommunications, including interception from three African government organisations; Microsoft recommends MFA, passwordless logins, avoiding consumer routers for corporate access, and timely updates.