Executive Summary
The Russian state-sponsored group APT28, also known as Fancy Bear or Forest Blizzard, is executing a significant campaign dubbed 'FrostArmada.' This campaign involves the compromise of internet-exposed Small Office/Home Office (SOHO) routers, specifically targeting MikroTik and TP-Link devices, alongside Nethesis and older Fortinet models. By exploiting weak management interfaces or vulnerabilities, the threat actor gains administrative access and alters DNS settings to redirect users to malicious infrastructure, primarily for harvesting Microsoft 365 credentials and OAuth tokens.
The campaign demonstrates a highly effective adversary-in-the-middle (AitM) tradecraft that bypasses multi-factor authentication (MFA) by intercepting legitimate OAuth tokens or abusing Device Code authentication flows. At its peak, the botnet comprised approximately 18,000 devices globally, impacting government agencies, financial services, and critical infrastructure sectors. While law enforcement actions have disrupted parts of the infrastructure, the techniques—including hijacking public Wi-Fi gateways at hotels and conference centers—remain a high risk for traveling employees and remote workers.