Executive Summary
Since August 2025, the Russian military intelligence actor Forest Blizzard, along with its sub-group Storm-2754, has targeted vulnerable small office/home office (SOHO) devices to facilitate large-scale DNS hijacking. By reconfiguring compromised edge routers to use actor-controlled DNS resolvers, the threat actor has established persistent visibility over the network traffic of over 200 organizations and 5,000 consumer devices.
The campaign leverages the legitimate dnsmasq utility to intercept and transparently proxy DNS requests. In high-priority cases, Forest Blizzard escalates to Adversary-in-the-Middle (AiTM) attacks by spoofing DNS responses to present invalid TLS certificates, specifically targeting Microsoft Outlook on the web and government servers in Africa. This allows for the collection of plaintext traffic, including emails and sensitive customer content.
This activity demonstrates a sophisticated pivot from unmanaged home infrastructure to enterprise and cloud assets, highlighting a significant risk for remote and hybrid work environments. The threat actor's ability to intercept encrypted connections via invalid certificate injection underscores the urgency of implementing phishing-resistant MFA and domain-based network controls.