Une campagne d’espionnage détourne des milliers de routeurs dans le monde

Le groupe de hackers Forest Blizzard pirate des routeurs SOHO vulnérables pour l'interception des flux Microsoft 365. Cette opération d'espionnage utilise une manipulation du DNS pour le vol de jetons d'authentification sans pénétration directe des serveurs de l'entreprise américaine.

Frostarmada forest blizzard dns hijacking

A DNS setting change on a single router can quietly reroute an entire network’s authentication traffic. In FrostArmada, Lumen observed Forest Blizzard using that technique ...

Russian Forest Blizzard Hackers Hijack Home Routers for Global Spying

Microsoft Threat Intelligence reveals how Russian hacking group Forest Blizzard uses home routers for DNS hijacking and spying.

Warnung aus UK: Russische Cyberkriminelle kapern Router zum Passwort-Klau

Das britische Cybersicherheitszentrum NCSC meldet Cyberangriffe auf Internetrouter. Die Bande aus Russland ist auch mehrerer Attacken in Deutschland verdächtig.

Feds Disrupt Russia-Backed Espionage Network Infecting 18,000 Devices

Feds disrupt Russia-backed espionage network infecting 18000 devices, learn how authorities stopped Forest Blizzard's massive credential theft operation now.

APT28 Hijacks SOHO Routers in Global DNS Espionage Push

APT28 hijacks SOHO routers in global DNS espionage, learn how to protect your network now and prevent DNS hijacking attacks today.

Russia Hacked Routers to Steal Microsoft Office Tokens – Krebs on Security

SOHO router compromise leads to DNS hijacking and adversary-in-the-middle attacks | Microsoft Security Blog

Executive summary Forest Blizzard, a threat actor linked to the Russian military, has been compromising insecure home and small-office internet equipment like routers, then modifying their settings in ways that turn them into part of the actor’s malicious infrastructure.

Nearest Neighbor Attack: Angriff über WLAN des Nachbarn

Multi-Faktor-Authentifizierung schützt nicht, wenn nicht alle Zugänge damit versehen sind – das musste ein US-Unternehmen durch APT28 lernen.

Windows vulnerability reported by the NSA exploited to install Russian malware

Microsoft didn't disclose the in-the-wild exploits by Kremlin-backed group until now.