Russian Hackers Hit SOHO Routers in Cyberespionage Campaign

Hackers tied to Russian military intelligence are continuing to refine attacks against home and small office routers for cyberespionage purposes, warn threat intelligence researchers at Microsoft.

See Also: Debunking the Myth: Securing OT Is Possible

A newly spotted campaign tied to Russia’s GRU Military Unit 26165 has been hacking SOHO routers domain name system settings in a manner that lets intelligence agents spy on normally encrypted Transport Layer Security traffic, says a Tuesday report from Microsoft.

Since at least August 2025, more than 200 organizations and 5,000 consumer devices have been exposed to the attackers’ DNS subterfuge. The targets span sectors including government, IT, telecommunications and energy organizations.

The nation-state hackers tied to the attacks are variously tracked by threat intel monikers that include APT 28, Fancy Bear, Sofacy Group, Forest Blizzard, Pawn Storm and Sednit. Microsoft said it’s also tracking this activity under the codename “Storm-2754,” with storm referring to “a newly discovered, unknown, emerging or developing cluster of threat activity.”

In this campaign, hackers remotely gain initial access to SOHO routers and changed the default settings, pointing them to an attacker-controlled DNS resolver. “Exploiting SOHO devices requires minimal investment while providing wide visibility on compromised devices, allowing the actor to collect DNS traffic and passively observe DNS requests,” Microsoft said.

Researchers didn’t detail how attackers gain initial access. Hackers often compromise edge devices that still have well-known, default passwords. Unpatched routers with known vulnerabilities or routers that are no longer supported by their manufacturer are also common gateways for an intrusion.

For most victims, DNS requests appeared to resolve as expected.

For a subset of victims, researchers found that the hackers launched an on-path attack designed to give them the ability to read normally encrypted TLS communications as plaintext.

To make this happen, “in a limited number of compromises, the threat actor spoofed DNS responses for specifically targeted domains to force impacted endpoints to connect to infrastructure controlled by the threat actor,” likely by using a lightweight network management tool called dnsmasq, Microsoft said.

“The actor-controlled malicious infrastructure would then present an invalid TLS certificate to the victim, spoofing the legitimate Microsoft service. If the compromised user ignored warnings about the invalid TLS certificate, the threat actor could then actively intercept the underlying plaintext traffic,” it said.

Microsoft said it identified the tactic as being used to access to Microsoft 365 domains associated with web-based Microsoft Outlook, as well as separate activity targeting non-Microsoft hosted servers in at least three government organizations in Africa.

If the intercepted data includes credentials or session cookies, hackers’ post-compromise activity would allow the actor to operate in the environment as a valid user, Microsoft said (see: Phishing Defense: Tracking Adversary-in-the-Middle Attacks).

Researchers said this level of access could be used to distribute malware or create a denial-of-service condition inside a targeted organization, although they haven’t observed such activity, so far.

This isn’t the first time GRU Military Unit 26165 has hit home routers. In February 2024, the U.S. Department of Justice announced that together with international partners and armed with a court order, it had “neutralized a network of hundreds of small office/home office routers” hacked by Russian military intelligence to serve as a cyberespionage attack platform. Subsequent phishing attacks and credential theft hit Russian intelligence targets, including the U.S. and foreign governments as well as private businesses (see: US Disrupts Russian Military Intelligence Botnet).

That campaign relied on a preexisting botnet designed to infect Ubiquiti Edge OS routers with Moobot malware. Officials said attackers only infected “routers that still used publicly known default administrator passwords.” As part of the disruption, the FBI instructed Moobot “to copy and delete stolen and malicious data and files from compromised routers” and also “modified the routers’ firewall rules to block remote management access to the devices,” to thwart further GRU access.

Microsoft said one essential defense against these types of attacks involves reviewing the cyber hygiene of remote workers’ edge infrastructure.

“It’s important for organizations to account for unmanaged SOHO devices – particularly those used by remote and hybrid employees – since compromised home and small office network infrastructure can expose cloud access and sensitive data even when enterprise environments and cloud services themselves remain secure,” it said.

The alert tying this Russian military cyberespionage hacking group to ongoing on-path attacks follows a rising number of warnings tied to the same attackers and their pursuit of foreign intelligence. This includes sophisticated malware. Cybersecurity firm Eset said that since 2024, the group has been wielding a “high-end custom arsenal” of “espionage implants” developed in-house, largely being used to target Ukrainian military personnel.

That shift is notable in part because beginning in 2019, the group appeared to be relying solely on simple scripts instead of sophisticated malware, primarily delivered through phishing attacks (see: Russia’s Unit 26165 Resumes High-End Malware Campaigns).

Other campaigns tied to the Russian nation-state hackers have included the use of malicious PDFs to compromise users of the free, Kyiv-based ukr.net webmail and news platform. Another effort involved the hacking of internet-connected cameras situated along border crossings and military installations, for targeting organizations in the air, sea and rail transportation sectors, as well as the IT and defense sectors.