Adversary Intelligence — 2026-04-27

APT28 Exploits SOHO Routers in Global DNS Hijacking Campaign FrostArmada

Lumen Black Lotus Labs attributed a campaign codenamed FrostArmada to APT28, with the DOJ separately tying the operation to GRU Military Unit 26165. Active since May 2025, the campaign exploited CVE-2023-50224 in TP-Link WR841N routers to alter DNS settings and redirect queries through actor-controlled nodes, enabling attacker-in-the-middle credential theft against TLS connections. At peak in December 2025, more than 18,000 unique IPs across 120 countries communicated with APT28 infrastructure; Microsoft counted over 200 organizations and 5,000 consumer devices impacted, with government ministries and law enforcement among primary targets. DOJ, FBI, and international partners disrupted the U.S.-based infrastructure in a court-authorized operation codenamed Operation Masquerade.

Analysis
FrostArmada confirms, per primary disclosures from Black Lotus Labs and Microsoft each with direct network telemetry, that GRU Unit 26165 has operationalized SOHO router compromise as a scalable bulk collection platform, running wide-aperture CVE exploitation to funnel harvested credentials and OAuth tokens toward downstream collection rather than using router access as a terminal intrusion technique. The NCSC's characterization of the approach as "opportunistic triage" resolves prior ambiguity about the campaign's deliberateness: victim concentration in foreign ministries, law enforcement agencies, and cloud providers across North Africa, Central America, and Southeast Asia reflects collection priority on third-country liaison and diplomatic traffic, not primary NATO or Five Eyes access. Organizations authenticating heavily through OWA-fronted cloud services were disproportionately present in the harvest regardless of standing collection priority, making structural exposure an equally plausible driver of the victim profile. Unit 26165 has rebuilt comparable infrastructure following every prior court-authorized disruption, and the underlying CVE remains unpatched across a large installed base of end-of-life TP-Link devices. The unit is likely to reconstitute a comparable router-based AitM collection network by mid-2027.

1 sources

Russian State-Linked APT28 Exploits SOHO Routers in Global DNS Hijacking Campaign - The Hacker News