Russia Hacked Routers: Massive DNS Hijack Steals Microsoft Office Tokens

Security analysts have confirmed that Russia hacked routers to siphon Microsoft Office authentication tokens, exploiting legacy DNS flaws on thousands of devices. The operation, attributed to the GRU‑linked group known as Forest Blizzard (also called APT28 or Fancy Bear), rewired DNS settings on vulnerable SOHO routers, directing traffic to attacker‑controlled servers that harvested OAuth tokens after users logged in.

How the DNS hijack worked

Researchers at Black Lotus Labs discovered that the hackers focused on outdated Mikrotik and TP‑Link units, many of which were past end‑of‑life and missing critical patches. By injecting rogue DNS entries, the compromised routers silently rerouted all internal requests, allowing the adversaries to capture tokens without deploying any malware. The stolen tokens, which are issued after multi‑factor authentication, gave the actors direct access to corporate and government Outlook accounts.

“They didn’t need a payload; they just twisted the DNS and walked away with credentials,” said Black Lotus security engineer Ryan English.

The campaign peaked in December 2025, ensnaring ↑ 18,000 routers and affecting over ↓ 5,000 consumer devices, according to Microsoft’s disclosure. More than 200 organizations, including foreign ministries and law‑enforcement agencies, were exposed.

Response and policy fallout

In March, the U.S. FCC announced a ban on certifying non‑U.S.‑made consumer routers, citing the “severe cybersecurity risk” posed by foreign hardware. While the policy stops new imports, existing equipment remains in use, prompting calls for rapid firmware updates and network segmentation.

Experts warn that similar DNS‑based man‑in‑the‑middle tactics could reappear if legacy equipment is not retired. The incident underscores the enduring value of simple, low‑tech exploits in state‑sponsored espionage.

For further details, see the Reuters report and Microsoft’s official blog.

Analysis by Nova Stirling (Aerospace & Space Tech Correspondent).