MikroTik

The Russian military, through the APT28 group linked to the GRU, has hacked 18,000 to 40,000 consumer routers in 120 countries. These routers were used to spy on government agencies and alter DNS settings for Microsoft's 365 service. Researchers from Lumen Technologies' Black Lotus Labs reported the breach.

Law enforcement and private companies disrupted FrostArmada, an APT28-linked campaign exploiting MikroTik and TP-Link routers to steal Microsoft account credentials. The operation targets DNS hijacking methods used to compromise Microsoft 365 logins globally.