Router DNS Hijacking Campaign Compromises 18,000 Devices Globally

The FrostArmada campaign exploited weak default configurations and unpatched vulnerabilities in MikroTik and TP-Link routers to perform DNS hijacking attacks. Attackers modified DNS settings to redirect authentication traffic through malicious proxies, enabling them to steal Microsoft 365 credentials and OAuth tokens from victims. This attack demonstrates how compromised network infrastructure can be weaponized to intercept sensitive authentication data, potentially giving attackers persistent access to corporate systems and data.

Tactical Insight

Immediate actions

Change default credentials on all network devices and implement strong authentication
Verify and harden DNS settings on routers to prevent unauthorized modifications
Scan all internet-facing routers for known vulnerabilities and apply security patches

Long-term improvements

Implement automated firmware update processes for network appliances
Deploy network monitoring to detect unusual DNS query patterns or configuration changes
Establish regular security audits of router configurations and access controls

Detection measures

Monitor authentication logs for suspicious login patterns or token usage
Implement DNS monitoring to identify unexpected query redirections
Deploy endpoint detection tools to identify compromised OAuth tokens