Routers as Silent Token Harvesters: Inside Russia's 18,000-Network Microsoft Office Campaign

Russia military intelligence harvested Office tokens from 18,000+ networks via compromised routers—no malware required. Detection gaps and mitigation strat

Routers as Silent Token Harvesters: Inside Russia's 18,000-Network Microsoft Office Campaign

Security teams focus on patching laptops, hardening endpoints, and monitoring process execution. Russian military intelligence focused on something simpler: the box that sits between your employees and the internet. The result: a campaign that harvested authentication tokens from Microsoft Office users across 18,000+ networks without deploying a single piece of malware.

The Campaign: Network-Layer Token Theft

In early 2026, the NSA and GCHQ published a joint advisory about a Russian state-sponsored campaign targeting internet routers manufactured by major vendors (Cisco, Fortinet, D-Link, TP-Link). The attack chain was elegantly simple:

1. Exploit Known Flaws: Attackers used previously disclosed (but unpatched) vulnerabilities in older router firmware to gain administrative access. Examples include CVE-2023-6780 (Fortinet FortiGate) and CVE-2024-21893 (D-Link).

2. Enable HTTPS Inspection: Once inside the router's admin panel, attackers configured the device's built-in TLS inspection feature (if available) or installed custom certificate stores.

3. Intercept Office Tokens: Every HTTPS request from Office desktop clients (Outlook, Teams, Word) passing through the compromised router was decrypted. Authentication tokens were extracted from the Certificate Authority validation handshake or API headers.

4. Harvest at Scale: A single compromised router in a corporate office could extract tokens from 50-200 simultaneous users. Across 18,000+ networks, the campaign yielded millions of valid OAuth tokens with access to sensitive Microsoft environments.

Why This Bypasses Everything

Traditional endpoint security assumes the network layer is trusted. Your SIEM monitors process execution, your EDR watches for malicious code, your firewall filters outbound traffic. None of these catch what happens inside the TLS tunnel—because the encryption key is already in the router's memory.

Detection Gaps:

EDR solutions can't see token theft happening in the network stack
SIEM alerts on failed logins, not successful token harvesting
DLP tools monitor egress of files, not authentication credentials
VPN clients bypass the router... unless they're corporate VPNs that terminate at the compromised gateway

Real-World Impact: The Microsoft Breach Door

Once attackers hold valid Office tokens, they don't need to crack passwords or deploy phishing campaigns. They can:

Access OneDrive and SharePoint directly (often housing sensitive project files)
Enumerate the organization's Azure AD via Microsoft Graph API
Join Teams channels and read message archives
Forward all emails to external accounts
Modify organizational policies if the compromised account has admin privileges

In several confirmed incidents, Russian actors used harvested tokens to move laterally into on-premises Active Directory environments via Azure AD Connect compromise.

How to Detect This (Harder Than It Should Be)

1. Token Anomalies: Monitor Azure AD sign-in logs for:

Token refreshes from unexpected geolocations (especially Russia/Belarus)
Bulk token refreshes from a single client IP (characteristic of router-based interception)
Office client tokens used from non-standard user agents (sign-in from an API call, not from Outlook)

2. Router-Level Indicators:

Unusual DNS queries from the router itself (indicating C2 communication)
Unexpected routes in the router's routing table
High memory usage or CPU spikes on the router (suggests packet inspection overhead)
Changes to the router's certificate store or TLS settings

3. Network Behavior:

Baseline Office client traffic patterns—sudden spikes in token refresh requests are abnormal
Monitor for Office API calls originating from unexpected source ports (routers often rewrite source IPs)

Immediate Mitigation

1. Inventory Your Routers: Document every router on your network, including firmware versions. Cross-reference against known vulnerable versions.

2. Patch or Replace:

Fortinet FortiGate: Update to 7.2.4+, 7.4.1+, or 7.6.0+
D-Link: Check vendor advisories (many older models have no patches—replace them)
TP-Link: Ensure firmware is current; many consumer/SMB routers are end-of-life

3. Disable TLS Inspection on Routers: If your router has built-in HTTPS inspection, disable it. Use endpoint-level DLP/inspection instead.

4. Enforce Device Compliance: Block Office clients that don't support modern OAuth flows (Office 2013 and older are riskier).

5. Monitor Token Lifecycle: Implement conditional access policies that invalidate tokens if they're used from unusual locations or patterns.

Why Supply Chain Matters

This campaign worked at scale because router firmware is updated infrequently. Many SMBs run routers with firmware from 2022-2023. The average time from patch release to deployment is 6+ months. Attackers exploit this gap by sitting on exploits for months before using them, knowing most targets won't patch in time.

Vouch's infrastructure scanning identifies routers running vulnerable firmware—a blind spot in most application security assessments.

Lessons

The most devastating breaches often don't involve sophisticated malware or zero-days. They exploit the fact that security teams focus on what they can see (endpoints, logs) while ignoring the infrastructure that connects everything. Your router doesn't run EDR. It doesn't alert when tokens are stolen. And by the time you notice the breach, attackers have already moved laterally into your most sensitive systems.

The 18,000-network campaign is a reminder: security is a chain, and the weakest link is often the one running firmware from 2 years ago.