Russia’s Forest Blizzard Is Abusing Home + Small Office Routers for Cred Theft

This week on the Microsoft Threat Intelligence Podcast, host⁠ ⁠⁠Sherrod DeGrippo (linkedin.com/in/sherroddegrippo) speaks with Danny Adamitis, Distinguished Engineer at Lumen Technologies’ Black Lotus Labs who break down how the Russian state-linked threat actor Forest Blizzard is exploiting home and small office routers to hijack DNS traffic, enabling large-scale surveillance and targeted credential theft. The conversation highlights how this low-cost approach scales globally, why unmanaged routers have become a critical weak point, and how tactics, from brute force to token theft to DNS hijacking continue to evolve.

In this episode you’ll learn:

•
How Forest Blizzard exploits home routers to intercept DNS traffic

•
Why unmanaged routers are a major blind spot in modern security

•
How tactics have evolved from brute force to token-based access

Some questions we ask:

•
What defines Forest Blizzard and how they operate?

•
How does this impact machine-to-machine or service account security?

•
What are the broader third-party or downstream risks?

Resources:

•
View Danny Adamitis on LinkedIn (linkedin.com/in/danny-a-44198047)

•
View Sherrod DeGrippo on LinkedIn (linkedin.com/in/sherroddegrippo)

•
Justice Department Conducts Court-Authorized Disruption of DNS Hijacking Network Controlled by a Russian Military Intelligence Unit (justice.gov/opa/pr/justice-department-conducts…)

•
FrostArmada: All thriller, no (malware) filler (lumen.com/blog/en-us/frostarmada-forest-blizza…)

Discover and follow other Microsoft podcasts atnews.microsoft.com/podcasts/https://news.micro…

Get the latest threat intelligence insights and guidance at Microsoft Security Insider (nam06.safelinks.protection.outlook.com/?url=ht…)

The Microsoft Threat Intelligence Podcast is produced by Microsoft, Hangar Studios and distributed as part of N2K media network.