Russia's Forest Blizzard Nabs Rafts of Logins Via SOHO Routers

Russia's APT28 hacking group has been conducting a global espionage campaign by exploiting vulnerabilities in small office and home routers from manufacturers like MikroTik and TP-Link. The attackers modify just one DNS setting in these compromised routers to redirect internet traffic through servers they control, allowing them to steal login credentials for email and web services without deploying any malware. The campaign has affected over 200 organizations worldwide, including government ministries, law enforcement agencies, and critical infrastructure across 23 US states, prompting a Justice Department disruption effort called Operation Masquerade.