Russia Hacked Routers to Steal Microsoft Office Tokens

A series of high-impact cyber incidents and trends: Russia-linked actors exploited known flaws in older consumer/enterprise routers to mass-harvest Microsoft Office authentication tokens from users on over 18,000 networks without deploying malware; a new phishing-as-a-service called “Starkiller” proxies real login pages and relays MFA codes to steal credentials; multiple large IoT botnets (Kimwolf, Aisuru, JackSkid, Mossad) infected millions of devices and enabled record DDoS activity (some infrastructure disrupted by law enforcement); Kimwolf was used to disrupt the I2P anonymity network and,