Forest Blizzard
Coverage of Forest Blizzard in the Nexus archive.
- FBI says Russian hackers hijacked old Wi-Fi routers
The FBI and Justice Department warned that Russian hackers linked to the GRU exploited vulnerabilities in outdated SOHO routers to conduct espionage by altering DNS settings and intercepting traffic. The hackers redirected internet requests through their servers to steal sensitive data, and authorities disrupted the U.S. portion of the network in April.
- APT28 Deploys PRISMEX Malware in Campaign Targeting Ukraine and NATO Allies
APT28, a Russian threat actor also known as Forest Blizzard and Pawn Storm, has launched a spear-phishing campaign targeting Ukraine and NATO allies using a new malware suite called PRISMEX. The malware employs advanced techniques like steganography, COM hijacking, and abuse of legitimate cloud services for command-and-control, according to Trend Micro.
- Russia Hacked Routers to Steal Microsoft Office Tokens
Russian military intelligence units, known as Forest Blizzard or APT28, used DNS hijacking to steal Microsoft Office authentication tokens from over 18,000 routers, primarily targeting government agencies.