SOHO router compromise leads to DNS hijacking and adversary-in-the-middle attacks

Key Takeaways

• Forest Blizzard (Storm-2754) is compromising SOHO routers at scale to conduct DNS hijacking.
• The actor uses the legitimate dnsmasq utility to forward DNS queries to actor-controlled infrastructure.
• Follow-on Adversary-in-the-Middle (AiTM) attacks are selectively conducted against high-priority targets to intercept TLS traffic.
• Over 200 organizations and 5,000 consumer devices have been impacted since at least August 2025.
• The attack relies on users ignoring invalid TLS certificate warnings to successfully intercept plaintext traffic.

Affected Systems

• Small office/home office (SOHO) routers
• Windows endpoints (via inherited DHCP/DNS settings)
• Microsoft Outlook on the web domains
• Government servers in Africa

Attack Chain

Forest Blizzard compromises vulnerable SOHO routers and alters their default network configurations to use actor-controlled DNS resolvers via the dnsmasq utility. Endpoint devices on the local network inherit these malicious DNS settings through DHCP. When a user attempts to access targeted services, the malicious resolver directs them to an AiTM server that presents a spoofed, invalid TLS certificate. If the user ignores the certificate warning, the threat actor intercepts the plaintext traffic to collect credentials and sensitive data.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: Yes
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No
• Platforms: Microsoft Defender XDR, Entra ID Protection

Microsoft provides KQL queries for Defender XDR to hunt for highly suspicious sign-ins and unusual post-compromise mailbox access activities.

Detection Engineering Assessment

EDR Visibility: Medium — EDR on the endpoint can observe the inherited malicious DNS settings and anomalous sign-in behaviors, but lacks direct visibility into the initial SOHO router compromise. Network Visibility: High — Network monitoring can detect anomalous DNS traffic, connections to unknown resolvers, and the presentation of invalid TLS certificates during the AiTM phase. Detection Difficulty: Moderate — While detecting the underlying router compromise is difficult for enterprise defenders, identifying the resulting risky sign-ins or invalid TLS certificates is feasible with proper identity and network monitoring.

Required Log Sources

• Entra ID Sign-in Logs
• CloudAppEvents
• DNS Query Logs
• Network Traffic Logs

Hunting Hypotheses

Hypothesis	Telemetry	ATT&CK Stage	FP Risk
Users are authenticating from unusual infrastructure or exhibiting risky sign-in behavior due to intercepted credentials.	Entra ID Sign-in Logs	Credential Access	Medium
Endpoints are querying non-standard or unexpected external DNS resolvers instead of corporate defaults.	DNS Query Logs	Command and Control	Low
Unusual search or mail item access patterns are occurring in cloud applications from suspicious IP addresses.	CloudAppEvents	Collection	Medium

Control Gaps

• Unmanaged SOHO devices lacking enterprise visibility
• Users ignoring TLS certificate warnings

Key Behavioral Indicators

• Unexpected DNS server assignments via DHCP
• High risk Entra ID sign-ins (RiskLevelAggregated == 100)
• ActionType 'Search' or 'MailItemsAccessed' from anomalous locations

False Positive Assessment

• Medium

Recommendations

Immediate Mitigation

• Enforce Zero Trust DNS (ZTDNS) on Windows endpoints to ensure devices only resolve DNS through trusted servers.
• Investigate Entra ID risky sign-in reports and risky user reports for signs of compromise.
• Block known malicious domains and monitor DNS logs for anomalous traffic.

Infrastructure Hardening

• Centralize identity management and integrate on-premises directories with cloud directories.
• Implement continuous access evaluation and sign-in risk policies to automate responses to risky sign-ins.
• Avoid using home router solutions in corporate environments.

User Protection

• Strictly enforce phishing-resistant MFA and Conditional Access policies, particularly for privileged accounts.
• Use passwordless solutions like passkeys via the Microsoft Authenticator app.
• Synchronize user accounts (excluding highly privileged ones) to maintain boundaries between on-premises and cloud environments.

Security Awareness

• Train users to never ignore TLS certificate errors or warnings.
• Educate remote and hybrid employees on the risks of insecure home network equipment.

MITRE ATT&CK Mapping

• T1584.004 - Compromise Infrastructure: Server
• T1565.002 - Data Manipulation: Transmitted Data Manipulation
• T1557 - Adversary-in-the-Middle
• T1040 - Network Sniffing