Token Theft via Router Compromise: The Russia Military Intelligence Campaign Targeting Office Users

Russian military intelligence harvests Microsoft Office tokens via compromised routers across 18,000+ networks. Detection patterns and defense strategies f

Token Theft via Router Compromise: How Russia's Military Intelligence Is Harvesting Office Tokens at Scale

One of the most unsettling security discoveries of April 2026 doesn't involve sophisticated zero-days or elaborate social engineering. Instead, Russian military intelligence units have quietly infected routers across 18,000+ networks to intercept Microsoft Office authentication tokens—a stark reminder that attackers often don't need to defeat your defenses directly when they can sit between your users and the internet.

The Attack Pattern: Why Routers Are the New Perimeter

Security researchers tracking this campaign have identified a chilling operational pattern: attackers are exploiting known vulnerabilities in older Internet routers to position themselves as man-in-the-middle (MITM) proxies. Once a router is compromised, the attacker doesn't need to deploy malware on individual endpoints. Instead, they simply intercept traffic flowing through the device and extract authentication tokens.

Why this works:

Most enterprise IT teams patch servers and workstations, but routers are often forgotten in maintenance cycles
Token extraction doesn't require code execution on the victim's machine—just packet inspection
Microsoft Office tokens grant access to email, OneDrive, Teams, and SharePoint—the keys to corporate networks
Attackers can stay dormant for weeks, harvesting credentials until the token is used

The scale is what's alarming: 18,000+ networks compromised, no malware needed, minimal forensic traces. The victims often don't know they've been breached until lateral movement is already underway.

Real-World Impact: Token Escalation to Full Compromise

Once a token is stolen, the attacker gains several advantages:

Immediate Access: A valid Office token is a skeleton key to corporate collaboration tools. The attacker can access email without triggering a failed login or MFA challenge (if the token was issued before MFA was enforced).

Lateral Movement: From SharePoint, the attacker can find sensitive documents, credentials stored in shared drives, and API keys. From Exchange, they can pivot to supply chain partners and customers via compromised inboxes.

Persistence: Stolen tokens can be valid for 24+ hours, giving attackers a wide window to establish persistent access through VPN credentials, admin accounts, or backup authentication methods.

Supply Chain Reach: If the compromised organization is a contractor or vendor to larger enterprises, the token becomes a foot-in-the-door for secondary attacks.

The Vouch Difference: Detecting Token-Based Lateral Movement

Traditional SIEM approaches focus on failed login events. But successful logins using stolen tokens blend into normal traffic. A token harvested from a compromised router may appear to come from the correct IP range, use the correct user agent, and follow normal access patterns.

Vouch's approach focuses on behavioral anomalies that token theft creates:

First-time token usage patterns: A token stolen at 2 AM might be first used from a different geography or network hours later
Impossible travel detection: A token moving between two locations too fast for a human to travel
Atypical resource access: A token from Finance accessing Engineering repositories or vice versa
API usage divergence: Tokens generating API calls inconsistent with the user's normal patterns

These signals emerge from analyzing successful authentication events, not just failures.

Defense Checklist for Router Compromise

Immediate Actions:

Audit your router inventory: firmware versions, end-of-life dates, patch status
Require mandatory VPN authentication for remote Office access—this adds an extra layer between routers and tokens
Enable token binding in Microsoft Office: This ties tokens to specific devices, rendering router-harvested tokens useless if the attacker can't also compromise the endpoint
Check your Microsoft audit logs for impossible geography logins (available in Enterprise tenant logs)

Longer-term Defense:

Implement Conditional Access policies that challenge tokens used from new locations or devices
Deploy reverse-proxy authentication that validates tokens server-side before granting access
Shift to passwordless authentication (Windows Hello, FIDO2) to reduce reliance on tokens as the sole proof of identity
Segment your network so that router compromise doesn't grant direct access to internal systems (zero-trust architecture)

Why This Matters for Your Organization

This campaign isn't targeted at advanced networks with cutting-edge defenses—it's targeting the infrastructure that most enterprises overlook. A forgotten router, a known vulnerability, 18,000 networks: this is industrial-scale espionage that costs attackers nothing and delivers massive returns.

The hard truth: your perimeter isn't your firewall or VPN. It's the weakest router on your network, connected to the internet, running firmware from 2022.

---

Further reading: Vouch's scanner detects router-derived tokens in access logs by analyzing behavioral entropy and geographic impossibilities. If you want to audit whether your organization's tokens have been compromised, start a free scan.