A major international law enforcement operation, conducted in partnership with private sector security teams, has disrupted a large-scale cyber campaign known as FrostArmada. The operation targeted infrastructure linked to APT28, the Russian state-backed threat group also known as Fancy Bear, Forest Blizzard, Sofacy, Sednit, Strontium, and Storm-2754.
🌍 The campaign demonstrates how attackers are increasingly abusing overlooked network devices such as small office and home office routers to gain access to valuable authentication traffic and steal credentials at scale.
A Router-Based Credential Theft Operation
At the center of FrostArmada was a simple but dangerous tactic: compromise internet-exposed routers, alter their DNS settings, and silently redirect selected traffic through attacker-controlled infrastructure.
According to the findings, APT28 primarily targeted MikroTik and TP-Link routers, along with some Nethesis firewall products and older Fortinet devices. Once a device was compromised, the attackers changed its DNS settings so that traffic would be resolved through virtual private servers under their control rather than legitimate DNS services.
🎯 This gave the threat actor the ability to intercept authentication requests to selected domains, including Microsoft-related services, and perform adversary-in-the-middle (AitM) attacks.
How the Attack Worked
The compromise chain was both effective and stealthy.
After taking control of vulnerable routers, the attackers pushed malicious DNS resolver settings onto the device. Those changes were then automatically distributed to internal clients through DHCP, meaning systems behind the router would begin using the malicious DNS infrastructure without the user realizing it.
When a victim attempted to connect to a targeted authentication-related domain, the malicious DNS server responded with an attacker-controlled IP address instead of the legitimate one. That redirected the connection to infrastructure controlled by the threat actor, which acted as a proxy between the victim and the real service.
In practice, the victim was still reaching the real destination, but only through the attacker’s controlled midpoint. That allowed the attackers to capture:
- 🔑 Microsoft account credentials
- 🧾 Session information
- 🎟️ OAuth tokens
- 📡 Other sensitive traffic associated with targeted accounts
⚠️ The most visible warning sign for the victim would likely have been an invalid TLS certificate alert. But in many environments, users click through certificate warnings without fully understanding the risk. If that happened here, the attackers could gain access to traffic that would otherwise have remained protected.
A Global Campaign at Scale
At its peak in December 2025, FrostArmada reportedly affected 18,000 devices across 120 countries. The campaign focused heavily on:
- 🏛️ Government agencies
- 🚓 Law enforcement organizations
- 💻 IT and hosting providers
- 🖥️ Entities operating their own servers
- 📬 Organizations with on-premises email infrastructure
Microsoft and Black Lotus Labs worked together to investigate the campaign, map its infrastructure, and help identify affected organizations. The operation also revealed that some attacks went beyond Microsoft-hosted services, with activity observed against government systems in Africa and other regions.
📍 Researchers also noted targeting in North Africa, Central America, and Southeast Asia, as well as a link to a national identity platform in one European country.
Two Operational Clusters
Black Lotus Labs reported that FrostArmada appeared to operate through two distinct functional clusters.
The first cluster, described as the “Expansion team,” focused on router compromise and botnet growth. Its job was to identify vulnerable devices, exploit them, and expand the number of infected endpoints.
The second cluster handled the AitM operations, traffic interception, and credential collection. This separation suggests a well-organized structure, with dedicated efforts for both infrastructure growth and intelligence harvesting.
🕵️ That level of specialization is consistent with the behavior of mature state-backed threat actors.
Law Enforcement Disruption
The campaign was disrupted through cooperation between Microsoft, Black Lotus Labs, the FBI, the U.S. Department of Justice, and the Polish government.
According to the DoJ, the FBI carried out a court-authorized technical operation to neutralize part of the threat actor’s infrastructure. That included issuing commands to compromised routers that removed APT28-controlled resolvers and reset the devices to use legitimate DNS resolvers provided by internet service providers.
The operation also enabled investigators to collect evidence regarding the threat actor’s activity, while authorities stated that the commands were carefully tested to avoid impacting router functionality or collecting user data.
✅ This was an important step in disrupting active malicious infrastructure, but it does not replace the need for users and organizations to secure their own devices.
Why This Campaign Matters
FrostArmada is a strong reminder that routers and edge devices remain one of the weakest points in many environments.
These systems are often:
- 🌐 Internet-exposed
- 👀 Poorly monitored
- ⏳ Running outdated firmware
- 🔓 Left with insecure management access
- 📦 Forgotten after initial deployment
For attackers, that makes them ideal pivot points. Instead of compromising endpoints directly, they can manipulate the network layer and quietly redirect traffic, harvest credentials, and monitor access attempts.
📛 The campaign also highlights how dangerous DNS hijacking remains. While DNS is often seen as simple background infrastructure, attackers who control it can influence where users connect, what systems they trust, and whether authentication traffic remains secure.
Defensive Lessons for Organizations
There are several practical lessons from FrostArmada for defenders.
1. Treat routers as critical assets
SOHO routers, branch devices, and small firewall appliances should not be treated as disposable hardware. They are part of the security perimeter and require the same care as servers and endpoints.
2. Patch aggressively
Known vulnerabilities in exposed edge devices remain one of the easiest paths for compromise. Unsupported and end-of-life devices should be removed as quickly as possible.
3. Review DNS settings regularly
Unexpected DNS resolvers in router configurations can be an early sign of compromise. Security teams should validate resolver settings as part of routine network hygiene.
4. Lock down remote management
Remote administration interfaces should never be exposed to the public internet unless absolutely necessary, and even then only with strict access controls.
5. Enforce certificate awareness
Users should never be trained to ignore TLS warnings. Certificate alerts may be one of the only visible signs that traffic is being intercepted.
6. Use certificate pinning where possible
For managed corporate laptops and mobile devices, certificate pinning can make interception attempts much more difficult and may trigger clear failures when malicious proxying occurs.
7. Reduce attack surface
Limiting public exposure, removing outdated equipment, and tightening firewall rules remain some of the most effective ways to reduce the chance of compromise.
Final Thoughts
FrostArmada shows how a sophisticated threat actor can turn everyday network hardware into a global credential interception platform.
By hijacking DNS on vulnerable routers, APT28 was able to quietly redirect authentication traffic, capture credentials and tokens, and build a large pool of potential intelligence targets across multiple regions and sectors. The campaign also reinforces a key reality of modern cyber defense: attackers do not always need malware on the endpoint when they can control the path the traffic takes.
🤝 The disruption of FrostArmada is a significant success for law enforcement and industry cooperation. But for defenders, the message is clear: patch exposed devices, retire unsupported hardware, verify DNS settings, and stop treating edge infrastructure as an afterthought.
💡 Because when routers are compromised, the network itself becomes the attack platform.
