Russia Hacked Routers to Steal Microsoft Office Tokens
2026-04-13T07:23:29Z•c197b7e8500c707a59a5a3fa345335279de3d994c4ec30f38bddc73e157be448
AisuruCanisterWormDDoSDaniil ShchukinGandCrabI2PIoT-botnetIranJackSkidKimwolfKimwolf-DortMossadREvilRussiaStarkiller MFA relay','multi-factor-authentication','Microsoft-PStrykerauthentication-tokensbotnetcredential-theftdoxingmilitary-intelligencenation-statephishing-as-a-servicerouterswiper
What happened
Collection of KrebsOnSecurity reports (Feb–Apr 2026) detailing multiple high-impact cyber campaigns and trends: Russian military-linked actors exploited known vulnerabilities in legacy routers to mass-harvest Microsoft Office authentication tokens from >18,000 networks; a high-profile dox reveals Daniil Shchukin (“UNKN”) as commander of GandCrab/REvil ransomware operations; a worm named CanisterWorm targets Iran-centric systems and performs destructive wiping; U.S., Canadian and German authorities disrupted four massive IoT botnets (Aisuru, Kimwolf, JackSkid, Mossad) that had infected millions
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- krebs_on_security
- Record identifier
- c197b7e8500c707a59a5a3fa345335279de3d994c4ec30f38bddc73e157be448
- Enrichment time
- 2026-04-13T07:23:29Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.