Russia Hacked Routers to Steal Microsoft Office Tokens

A series of high-impact security incidents and trends: Russian state-linked actors exploited known flaws in older consumer/SMB routers to mass-harvest Microsoft Office authentication tokens from >18,000 networks; large IoT botnets (Kimwolf, Aisuru, Kimwolf-related infrastructure) that compromised millions of devices were disrupted by law enforcement but remain a major DDoS threat; new phishing-as-a-service (“Starkiller”) proxies real login pages and relays MFA codes; a wormy wiper (“CanisterWorm”) targets systems using Iran time zone/Farsi and an Iran-linked group claims a wiper attack on med‑