Russian Actor Turns Consumer Routers into Persistent Surveillance Nodes
A Russian military-linked actor named Forest Blizzard has shifted from merely breaking into routers to converting consumer-grade SOHO and home routers into legitimate-looking infrastructure. This gives the actor persistent DNS control and passive visibility at the network boundary, making their presence much harder to detect than traditional implants. Since at least August 2025, Forest Blizzard has hijacked DNS on over 5,000 consumer devices across more than 200 organizations, enabling adversary-in-the-middle surveillance and reconnaissance at scale.
This approach allows the actor to observe and alter network traffic before it reaches any endpoint or security stack inside the network. Standard endpoint defenses and credential rotations do not remove the attacker from the network path, expanding the blast radius to the entire network behind the compromised device. This campaign is especially relevant for organizations relying on consumer-grade routers for remote work or small office/at