FrostArmada

A DNS setting change on a single router can quietly reroute an entire network’s authentication traffic. In FrostArmada, Lumen observed Forest Blizzard using that technique to feed targeted logins into Attacker-in-the-Middle (AitM) infrastructure, scaling from limited activity to thousands of victims worldwide. Learn how we tracked it, how it impacted target organizations and what you can do to defend your organization against it.

Black Lotus Labs, the threat research team at Lumen Technologies, has been tracking a campaign named “FrostArmada” associated with the threat actor group “Forest Blizzard” and its affiliated monikers . We assessed that this network was created and exclusively operationalized by the Forest Blizzard threat actor and is used to conduct operations against targeted organizations aligned with that actor’s strategic interests.

This campaign was notable as it demonstrated a new tactic for Forest Blizzard. Their technique modified DNS settings on compromised routers to hijack local network traffic to capture and exfiltrate authentication credentials. When targeted domains were requested by a user, the actor redirected traffic to an Attacker-in-the-Middle (AitM) node, where those credentials were harvested and exfiltrated. This approach enabled a nearly invisible attack that required no interaction from the end user.

The earliest activity began in May 2025, with limited targeting. However, after the NCSC released its report, Authentic Antics , on August 5, 2025 describing a tool for stealing Microsoft Office credentials, Lumen detected widespread router exploitation and DNS redirection starting August 6, 2025. This timing indicates that the threat actor quickly adapted their methods.

At the peak of activity in December 2025, Lumen detected over 18,000 unique IPs from at least 120 countries communicating with Forest Blizzard’s infrastructure. These operations primarily targeted government agencies—including ministries of foreign affairs, law enforcement, and third-party email providers.

To address this threat, we shared threat intelligence with relevant public and private organizations. Lumen would like to thank the Microsoft Threat Intelligence Team (MSTIC), FBI, and U.S. Department of Justice (DOJ) for their support. At the time of publication, Lumen blocked traffic to the affected infrastructure and added Indicators of Compromise (IOC) into Lumen Defender SM to protect our customers. For additional information on this campaign, please see MSTIC's report here .

The Lumen team is actively tracking Forest Blizzard, a highly adaptive and persistent threat actor linked to Russia’s GRU Unit 26165. Known for blending cutting-edge tools such as the large language model (LLM) “ LAMEHUG ” with proven, longstanding techniques, Forest Blizzard consistently evolves its tactics to stay ahead of defenders. Their and current campaigns highlight both their technological sophistication and their willingness to revisit classic attack methods even after public exposure, underscoring the ongoing risk posed by this actor to organizations worldwide.

One of Forest Blizzard’s primary activities is email collection, particularly targeting organizations in the logistics, defense and government sectors. For instance, in 2021, this actor was observed conducting systemic brute-force password spraying against Microsoft services to gain unauthorized access to email accounts. In 2023, as multi-factor authentication became more widely adopted, Forest Blizzard shifted to Spear phishing attacks that redirected victims to compromised routers to harvest NTLM hashes . While this approach likely yielded better results, it required significantly more resources than password spraying. In other cases, they directly targeted the email server itself to deploy tools such as “NotDoor,” which deepen their access into the systems.

To achieve their goals, Forest Blizzard reverted to an established technique that exploits a fundamental internet technology: DNS. Instead of pursuing new zero-day vulnerabilities, they leveraged weaknesses in the DNS ecosystem which, despite being well documented, remain challenging to address on a global scale. By implementing DNS hijacking at a highly localized level, they managed to avoid detection—unlike a actor —while still fulfilling their objectives.

In this post, we cover:

During our investigation, we discovered two distinct activity clusters associated with the campaign. The first cluster we refer to as the “expansion team.” We assessed that this was a distinct cluster of activity focused on exploiting new devices and bringing them under the control of the threat actor by targeting a large pool of networking equipment via common web interface ports. We suspect the actor attempted to exploit CVEs associated with vulnerabilities in the web-interface on TP-Link and MikroTik routers. After targeted devices made initial communication with Forest Blizzard infrastructure, we subsequently observed a volume of data transfer, which denotes the changes made by the actor.

We observed a similar pattern of activity stemming from the same cluster to networking equipment that was exposed to the internet, such as enterprise-grade firewalls like Fortinet. Analysis revealed these to be older models and thus we suspect that they were vulnerable to known CVEs. We also observed connections to smaller-brand firewall products such as Nethesis. We suspect that these devices were targeted opportunistically because they are not connected to any of the sectors listed in the Joint Cybersecurity Advisory on GRU cyber campaigns—including government, defense contractors, IT providers, political organizations, energy and logistics.

As the targeted routers in the image above were infected by the expansion team, their DNS settings were modified to communicate with actor-controlled VPS nodes acting as DNS resolvers.

One of the most concerning techniques associated with this campaign was the harvesting of OAuth tokens from workstations on the adjacent LAN of a compromised router. We assess that the actors did not find any vulnerabilities in the underlying authentication protocol . Instead, these authentication tokens were obtained through DNS hijacking coupled with an Attacker-in-the-Middle capability. We assess that the actors employed the following methodology:

Lumen identified the first AitM node at the IP address 64.120.31[.]96 in May 2025. Further analysis showed it began receiving inbound DNS requests on May 19, 2025, from a MikroTik router associated with the government of Afghanistan. This node continued receiving DNS requests from a second Afghan government entity, as well as a few Nethesis firewalls based in Italy, throughout November 2025.

Lumen then observed a second AitM node at the IP address 79.141.160[.]78 , which became significantly more active on August 6, 2025. Interestingly, this was the day after the UK NCSC released its report documenting a new malware family dubbed Authentic Antics, which describes a Forest Blizzard-associated malware tool designed to “intercept and exfiltrate Microsoft Office account credentials and tokens.” This suggested that as one capability was disclosed, the actor immediately shifted to another to continue acquiring authentication material.

This second AitM node processed both standard DNS and DNS over TLS (DoT) requests as it functioned as a recursive resolver. This IP address, 79.141.160[.]78 , was notable because at the time it was the only node in our telemetry with observed DoT activity. While the first AitM was regionalized in focus, the second node interacted with entities worldwide. We noted that most of the impacted routers appeared to be either MikroTik or TP-Link.

While this technique initially began as a targeted, bespoke capability, it proliferated in the second half of 2025 and the start of 2026. In a one-month snapshot from December 12, 2025, to January 13, 2026, we observed that over 290,000 distinct IP addresses sent at least one DNS request to the actor-managed DNS servers. However, when we filtered the list to IP addresses that had at least five interactions with the DNS server over a month, the list dropped to approximately 40,000. We would categorize these as low-confidence victims. Tightening the parameters to include only IP addresses with 10 observed interactions in a 30-day period, the number of moderate-confidence victims dropped to 18,000.

Once Lumen identified the malicious AitM server, we used our global telemetry to look for outbound connections from AitM nodes to email services. We suspect that a connection to any of these services indicated a successful hijack of at least one account.

The initial analysis indicated that the victims included organizations operating their own email servers, as well as certain government agencies. These entities correlated to the ministries of foreign affairs and national law enforcement in certain North African, Central American and Southeast Asian countries. There was also a connection to a national identity platform in one European country.

Most victims were associated with third-party IT, hosting and smaller cloud service providers in Europe. However, it is difficult to know where the end user of these services resides. We also identified connections to various email services providers, both in the U.S. and across Europe. These connections indicate that individual accounts were compromised rather than any systemic compromise of the backend systems.

Forest Blizzard has updated its methods over the years, but its campaign principles and intelligence objectives remain constant, despite changes in email attack techniques. This threat actor has and almost certainly will continue to pursue this information in the future. Given their habit of adapting and continuing operations even after public exposure of their methods, we expect them to resume their activities by other means and will continue to track and observe them.

As our investigation progressed, we added IOCs to Lumen Defender SM to protect our customers. We recommend that organizations in the verticals named in the Joint Cybersecurity Advisory implement hardening procedures, set up alerting and review incident response plans. We have not found any new exploits in this campaign. However, to protect your corporate resources and prevent your equipment from being compromised, we recommend that you:

Analysis of the FrostArmada network was performed by Danny Adamitis with technical editing by Ryan English.

If you would like to collaborate on similar research, please us on or X @BlackLotusLabs.