Today, Microsoft’s Threat Intelligence team released a blog uncovering operations by Forest Blizzard, a Russian military-linked threat actor. The blog, released alongside an FBI disruption, outlines how the group turned insecure home and small office (SOHO) routers into nation‑state surveillance platforms.
Since at least August 2025, Forest Blizzard has been exploiting vulnerable SOHO internet devices to hijack DNS traffic, enabling passive collection of network data while concealing follow‑on operations behind legitimate infrastructure. This approach allows the actor to gain visibility into larger, more hardened environments without directly breaching corporate networks.
· While SOHO device infiltration isn’t new, this is the first time Microsoft has observed DNS hijacking used at scale to directly support adversary‑in‑the‑middle (AiTM) attacks against TLS connections.
· Microsoft has identified more than 200 organisations and 5,000 consumer devices impacted by Forest Blizzard’s infiltration.
· Although no compromise of Microsoft‑owned assets was observed, researchers assess the operation represents a significant escalation in how nation‑state actors weaponise unmanaged edge devices and could enable larger‑scale active interception in the future.
