Hackers are turning home routers into tools to spy on Microsoft 365 users

Microsoft says Forest Blizzard, also known as Storm-2754 and Fancy Bear, targeted thousands of personal and SOHO routers.

The Kremlin-sponsored group has been active since at least August 2025, Microsoft’s Threat Intelligence team said.

The campaign affected more than 200 organizations and 5,000 consumer devices.

Attackers changed router DNS settings to keep access, intercept DNS traffic, and route traffic through malicious DNS infrastructure.

Microsoft says the group used recovered intelligence for man-in-the-middle attacks on Microsoft 365 domains; it also shared mitigations for enterprises, end users, and Windows.