Russia Hacked Routers to Steal Microsoft Office Tokens

Microsoft and Black Lotus Labs warn that Russia-linked GRU actors known as Forest Blizzard (APT28/Fancy Bear) conducted a large-scale DNS hijacking campaign by exploiting known flaws in older Mikrotik and TP-Link SOHO routers to redirect DNS to attacker-controlled servers, enabling AiTM interception of OAuth tokens for Microsoft Office/Outlook web; the covert campaign impacted over 18,000 routers, around 200 organizations (including government ministries) and several thousand consumer devices without deploying malware.