Russian Hackers Exploit SOHO Routers for DNS Hijacking Campaign

Researchers attribute a large-scale SOHO router compromise campaign to the Russia-linked Forest Blizzard group (Storm-2754), which alters router DNS settings (using dnsmasq) to hijack DNS queries for passive surveillance and selective AiTM attacks that can intercept TLS-protected communications; Microsoft telemetry identified impacts to over 200 organizations and 5,000 consumer devices, and recommended mitigations include Zero Trust DNS, centralized identity controls, MFA/Conditional Access, and enabling endpoint DNS/web protections.