Router Token Theft: Russia's Military Campaign Harvesting Microsoft Office Credentials at Scale
Russian military harvested 450K+ Office tokens from compromised routers. No malware. No alerts. What failed and how to detect token theft now.
Router Token Theft: Russia's Military Campaign Harvesting Microsoft Office Credentials at Scale
On April 16, 2026, researchers announced: Russia's military intelligence (GRU) compromised over 18,000 networks to steal Microsoft Office 365 authentication tokens—without deploying malware.
No malware. No EDR detection. No email gateway alerts. Just tokens.
How 18,000 Networks Got Hacked Without Malware
The attack exploited known vulnerabilities in older routers (D-Link, TP-Link, Netgear models from 2018-2021). These routers handle all traffic flowing in and out of corporate networks.
The vulnerability: Command injection flaws allow execution of arbitrary commands on the router.
The exploit: The GRU:
1. Installed a minimal packet-sniffer on compromised routers
2. The sniffer watches all HTTPS traffic
3. Identifies OAuth 2.0 token requests to login.microsoftonline.com
4. Extracts bearer tokens from TLS connections (sniffer sits before encryption happens)
5. Exfiltrates tokens to GRU servers
Critical detail: The encryption didn't matter. Because the sniffer sits at the router—before TLS encryption—it reads everything before encryption.
Why Every Defense Failed
EDR didn't catch it: EDR monitors individual machines. This attack happens at the router.
Email gateway didn't catch it: Gateways guard email, not Office tokens.
VPN didn't catch it: Home workers over WiFi route through the compromised router unencrypted.
SIEM missed it: No new processes, registry changes, or suspicious files. Just packets being read.
The Math
Researchers identified 18,000 compromised routers. Each network exposed:
- 500 Office users × 5 tokens/user/day × 180 days = 450,000 tokens harvested
- 10-15% represent admin accounts = 45,000-67,500 high-value tokens
With a valid token, attackers can:
- Read all emails
- Access OneDrive files
- Modify SharePoint documents
- Export Teams conversations
- Create new accounts (if admin)
- Grant permissions (if admin)
Campaign duration: Mid-2024 through April 2026 = 20 months of undetected token harvesting.
Estimated compromised individuals: 180,000+
Why Defense Failed
Problem #1: Router patching has zero urgency. Your security team patches servers and workstations. The router in the closet from 2019 "just works." Known vulnerabilities persist 3-5 years.
Problem #2: Token exposure has no standard monitoring. SIEM monitors logins and file access, not:
- How many tokens are requested
- From what locations tokens are used
- Unusual token patterns
Problem #3: Routers aren't security boundaries. Teams treat routers as dumb pipes, don't install IDS/IPS, don't encrypt internal traffic, don't monitor logs.
Defense Checklist
Immediate:
- Audit router inventory: firmware versions, patch status
- Require mandatory VPN for remote Office access
- Enable token binding in Microsoft Office (ties tokens to devices)
- Check Microsoft audit logs for impossible geography logins
Long-term:
- Conditional Access policies: challenge tokens from new locations
- Reverse-proxy authentication: validate tokens server-side
- Passwordless auth: Windows Hello, FIDO2
- Network segmentation: router compromise doesn't grant internal access
What This Means
Your perimeter isn't your firewall. It's the weakest router on your network, running firmware from 2022, connected to the internet.
The hard truth: 18,000 compromised networks, no malware, minimal forensic traces. The victims often don't know until lateral movement is underway.
---
Vouch Security Scanner detects router-derived tokens in access logs by analyzing geographic impossibilities and behavioral entropy. Start a free scan.