No Malware Needed: APT28's Router Token Harvesting Spree

Just saw the detailed report on Krebs regarding Russian military intelligence units (likely APT28) leveraging known vulnerabilities in end-of-life SOHO routers. This campaign is massive—impacting over 18,000 networks—and the scary part is the complete lack of malware on the endpoints.

Instead of infecting laptops, they are compromising the edge devices (routers) to passively harvest Microsoft 365 authentication tokens. By sitting on the router, they can intercept AD FS or OAuth tokens in transit. Since the traffic originates from a "trusted" internal IP, standard UEBA and heuristic detection often fails to flag the authentication attempt as anomalous until it's too late.

Most of these targets are likely older Cisco, Netgear, or DrayTek devices that haven't seen a firmware update in years. The attackers are essentially "living off the land" by abusing the router's native management functionality or CVEs from years past (think CVE-2017-6736 or similar generic remote execution flaws).

For detection, we have to shift focus to the network edge. I'd recommend checking for anomalous outbound traffic from router IPs that shouldn't be talking to Microsoft login endpoints directly. Also, if you have legacy gear, block internet access to the management interfaces immediately.

Here is a quick snippet to scan your internal subnet for common vulnerable ports (like Telnet or HTTP management interfaces) that should probably be disabled:

# Quick scan for open management ports on common gateway IPs
$gateways = @("192.168.1.1", "192.168.0.1", "10.0.0.1")
$ports = @(23, 80, 443, 8080)

foreach ($ip in $gateways) {
    foreach ($port in $ports) {
        $result = Test-NetConnection -ComputerName $ip -Port $port -WarningAction SilentlyContinue
        if ($result.TcpTestSucceeded) {
            Write-Host "[!] Open Port: $port on $ip" -ForegroundColor Red
        }
    }
}


Is anyone else seeing a resurgence in router-based attacks recently? How are you handling clients who refuse to replace EOL gear because "it still works"?