Storm-2754

Storm-2754 is a Microsoft-tracked component of Forest Blizzard, a threat actor linked to the Russian military. It is associated with intelligence-collection operations that support Russian government foreign policy objectives. Since at least August 2025, this component has been observed exploiting vulnerable SOHO and home routers, modifying device DNS settings, and repurposing compromised edge devices as covert malicious infrastructure. The group’s activity centers on DNS hijacking at scale. By redirecting downstream devices to actor-controlled resolvers, Storm-2754 gains persistent passive visibility into victim network traffic and creates conditions for selective adversary-in-the-middle operations. In most observed cases, DNS traffic was transparently proxied so users still reached legitimate services, preserving stealth while enabling reconnaissance. In a smaller subset of cases, the actor spoofed DNS responses for selected high-value targets, including webmail and government-related services, and presented invalid TLS certificates in an attempt to intercept plaintext traffic if users bypassed certificate warnings. This activity reflects a combination of edge-device exploitation, covert infrastructure abuse, reconnaissance, persistence, spoofing, and post-compromise collection. The campaign affected organizations and consumer devices across government, information technology, telecommunications, and energy environments. Microsoft identified this as the first observed instance of Forest Blizzard using DNS hijacking at scale to support TLS adversary-in-the-middle operations following edge-device exploitation. Although such positioning could enable additional actions such as malware delivery or service disruption, the observed campaign was assessed primarily as information collection rather than destructive or financially motivated activity. Known naming in this context includes Storm-2754 as the tracked component and Forest Blizzard as the broader cluster to which it is attributed.