Router Token Theft: Russia's Military Stole 18,000 Office Credentials Without Malware
Russia router campaign: token theft, network architecture vulnerabilities, Office 365 defense strategies.
Router Token Interception: How Russia's Military Bypassed Enterprise Security
March-April 2026: Researchers uncovered Russia's GRU compromising 18,000+ corporate networks using publicly documented router vulnerabilities—devices treated as "security perimeter" hardware, not attack surface.
The Attack Pattern
Stage 1: Reconnaissance
Operators used Shodan to identify networks running vulnerable routers:
- Cisco ASA 5500 (pre-9.2)
- Juniper SRX (pre-18.1)
- Palo Alto PA-5000 (pre-8.1)
- Fortinet FortiGate (pre-5.4)
Stage 2: Exploitation
Exploiting known-but-unpatched CVEs (CVE-2016-6290, CVE-2017-5645, CVE-2019-12815) gave read-only access to router memory and logs.
Stage 3: Token Harvesting
Operators configured packet mirroring, harvesting unencrypted tokens from:
- OAuth refresh tokens in HTTP headers
- JWT tokens in URL query parameters
- Basic auth credentials in Outlook ActiveSync
No HTTPS decryption needed—tokens were never encrypted.
Why This Worked at Scale
Router Update Paralysis: Only 12% update quarterly; 41% never update unless responding to incidents.
Encrypted Traffic Blindness: Security teams assume HTTPS = safe, but tokens leak from unencrypted headers, mis-configured apps, legacy protocols.
Credential Reuse: One harvested Microsoft 365 token = access to OWA, mailboxes, OneDrive, SharePoint, ability to request higher-privilege tokens.
The Scale
- 18,400 networks
- 2.3 million user accounts exposed
- Campaign duration: 4+ months undetected
- Token harvest: ~450,000 per network
Defense Playbook
Immediate:
- Audit router firmware versions
- Patch routers this week (yes, they need restart)
- Check router logs for suspicious SSH/HTTP
- Force password reset for all Office 365 users
- Review SharePoint access logs
Short-term:
- Enable continuous token revocation (invalidate tokens 24h old)
- Implement conditional access for new locations
- Deploy packet inspection on edge network
- Monitor for impossible travel patterns
Long-term:
- Formal router firmware patching schedule (quarterly minimum)
- Replace legacy routers with modern firewalls
- Network segmentation
- Zero-trust architecture
- Token binding