Law Enforcement Disrupts FrostArmada APT28 DNS Hijacking Campaign Targeting Microsoft 365 Logins
An international law enforcement operation in collaboration with private cybersecurity firms has disrupted FrostArmada, an APT28 cyber espionage campaign that hijacked DNS settings on MikroTik and TP-Link routers to intercept and steal Microsoft account logins.
What happened
Authorities working with private companies conducted an operation that took down FrostArmada, a cyber espionage campaign attributed to APT28. The campaign hijacked DNS traffic from compromised MikroTik and TP-Link routers, redirecting users to malicious sites to capture Microsoft account credentials.
Why it matters
The disruption of FrostArmada mitigates a sophisticated threat that exploited common network hardware to steal login credentials for Microsoft accounts, highlighting the ongoing risk posed by router-targeted attacks and the importance of coordinated law enforcement actions to protect users.
Key technical details
FrostArmada targeted vulnerabilities in MikroTik and TP-Link routers to hijack local DNS traffic. By redirecting legitimate Microsoft 365 login attempts to phishing sites, the attackers captured user credentials. The coordinated takedown involved dismantling infrastructure supporting this hijacking and preventing further credential theft.
Affected organizations/products
Microsoft 365 users whose network traffic passed through compromised MikroTik and TP-Link routers were targeted by the FrostArmada campaign.
Source attribution
