Home routers vs. cloud defenses: How APT28 pairs mass DNS hijacks with stealth Microsoft 365 token theft
APT28 (Fancy Bear, GRU Unit 26165) has shifted from classic phishing and malware to a hybrid approach that begins on compromised home and SOHO routers and finishes inside Microsoft 365 environments—using DNS hijacking and a cloud-native malware toolkit called “AUTHENTIC ANTICS” to steal OAuth tokens and live cloud content. That contrast—network infrastructure compromise at the […]
