Russian Hackers Use Router DNS Hijacking to Steal Microsoft Office Tokens

If you are running a small business near the bustling corridors of downtown Seattle or managing a home office in the rainy outskirts of Bellevue, the security of your internet router might feel like a background task—something you set up once, and forget. Although, recent intelligence reveals that the very devices we trust to connect us to the world are being turned into silent conduits for foreign espionage. A sophisticated campaign by a Russian military intelligence unit has turned thousands of common SOHO (Small Office/Home Office) routers into a massive surveillance dragnet, and the implications for Pacific Northwest professionals using Microsoft Office are particularly concerning.

The “Graybeard” Approach to Modern Espionage

While we often imagine cyberattacks as complex pieces of malware or “zero-day” exploits, the threat actor known as Forest Blizzard—also identified as APT28, Fancy Bear, and the Sofacy Group—has opted for a remarkably simple, “old-school” method. According to Ryan English, a security engineer at Black Lotus Labs (a division of the internet backbone provider Lumen), these actors didn’t need to install any malicious software on the routers. Instead, they exploited known vulnerabilities in older, unsupported, or unpatched hardware to modify the Domain Name System (DNS) settings.

For those unfamiliar with the technicals, DNS is essentially the phonebook of the internet. When you type a web address, the DNS translates it into an IP address. By hijacking this process, Forest Blizzard redirected traffic to servers they controlled. This allowed them to implement “Adversary-in-the-Middle” (AiTM) attacks. Rather than trying to steal your password through a fake email, they waited for you to log in legitimately. Once you passed through multi-factor authentication, the attackers intercepted the OAuth authentication tokens. This effectively gave them a “golden key” to enter Microsoft Office accounts without needing to phish for credentials or one-time codes.

A Scale of Compromise That Defies Intuition

The scale of this operation is staggering. Black Lotus Labs found that at the peak of activity in December 2025, the dragnet ensnared over 18,000 routers. Microsoft reported identifying more than 200 organizations and 5,000 consumer devices caught in this network. The targets were not random; the hackers primarily focused on government agencies, including law enforcement and ministries of foreign affairs, as well as third-party email providers. In the U.S., the Department of Justice and the FBI recently conducted a court-authorized operation to neutralize the American portion of this network, specifically targeting the infrastructure used by GRU Military Unit 26165.

The vulnerability was most prevalent in older MikroTik and TP-Link devices. Many of these were finish-of-life products that no longer received security updates, making them easy targets for a group that had already shifted its tactics. Danny Adamitis of Black Lotus Labs noted that after a previous report from the U.K.’s National Cyber Security Centre (NCSC) in August 2025, Forest Blizzard abandoned a smaller-scale malware approach in favor of this systemic, mass-alteration of DNS settings.

National Security and the FCC’s Hard Line

This breach has contributed to a shift in how the U.S. Government views consumer-grade hardware. On March 23, the Federal Communications Commission (FCC) announced a sweeping policy to no longer certify consumer-grade internet routers produced outside of the United States. The FCC warned that these foreign-made devices represent an untenable national security threat, capable of disrupting critical infrastructure and harming U.S. Persons. While this doesn’t affect routers already in your home, it creates a significant hurdle for manufacturers like TP-Link, who were already facing potential bans.

View this post on Instagram

For a tech-heavy hub like Seattle, where the density of remote workers and small tech startups is immense, this is a wake-up call. The reliance on Internet of Things (IoT) devices often creates a “blind spot” in network security. When the gateway—the router itself—is compromised, every device on that network, from your laptop to your smart thermostat, is potentially exposed to traffic interception.

The Second-Order Effect on Remote Work

The most insidious part of the Forest Blizzard campaign is its invisibility. Because no malware was installed, traditional antivirus software on a PC or Mac would not detect the breach. The compromise happens at the hardware level. This creates a precarious situation for professionals who handle sensitive data via Microsoft Outlook Web Access. If your router is redirecting your DNS requests, you are essentially handing your authentication tokens to a foreign intelligence agency every time you log in to check your email.

Securing Your Local Network in Seattle

Given my background in analyzing these systemic risks, if you are operating a business or a home office in the Seattle-Tacoma area, you cannot afford to ignore your hardware’s “end-of-life” status. If your router is five years old and hasn’t had a firmware update in months, We see essentially an open door. To mitigate these risks, you need more than just a password change; you need a structural audit of your network edge.

If you suspect your network has been compromised or you want to prevent becoming part of a future “dragnet,” here are the three types of local professionals you should engage:

Managed Security Service Providers (MSSPs): Glance for firms that specialize in “Edge Security” and “DNS Filtering.” You want a provider that doesn’t just install software but performs a physical audit of your hardware. Ensure they have a protocol for identifying end-of-life (EOL) hardware and can implement secure, encrypted DNS providers (like DNS over HTTPS) to prevent hijacking.
SOHO Network Architects: For small businesses, hire a consultant who focuses on Small Office/Home Office architecture. The criteria here should be their ability to segment your network—separating your “guest” IoT devices from your “critical” work devices—so that a compromise of one device doesn’t lead to the theft of Microsoft Office tokens from your primary workstation.
Compliance and Cybersecurity Auditors: If you work with government contracts or sensitive legal data, seek auditors who can verify your network against current FCC and CISA guidelines. Look for professionals who can provide a “vulnerability assessment” specifically targeting your router’s firmware and DNS configuration to ensure you aren’t leaking data to unauthorized resolvers.

Ready to find trusted professionals? Browse our complete directory of top-rated alittlesunshine,internetofthings,latestwarnings,neerdowellnews,thecomingstorm,apt28,blacklotuslabs,dannyadamitis,fancybear,forestblizzard,lumen,microsoftoffice,mikrotik,nationalcybersecuritycentre,ryanenglish,tplink experts in the Seattle area today.