A large-scale campaign by Forest Blizzard, a Russian military-linked threat actor, targeting home and small-office routers to hijack DNS traffic and intercept encrypted communications with over 200 organizations and 5,000 consumer devices already compromised. On April 7, the FBI announced Operation Masquerade, a court-authorized takedown of compromised routers on U. The Russian military is once again hacking home and small office routers in widespread operations that send unwitting users to sites that harvest passwords and credential tokens for use in espionage campaigns, researchers said. Recent warnings from security experts have unveiled a sophisticated cyber espionage campaign attributed to units linked with Russia's military intelligence, commonly associated with the advanced persistent threat (APT) group known as APT28 or Fancy Bear. Forest Blizzard (also tracked as APT28. British security officials found that a group linked to the Russian military is spying on users of compromised Small Office/Home Office (SOHO) routers in a broad cyber espionage campaign. A Microsoft blog goes into the technical details of these attacks.
[PDF Version]