Russian military intelligence-linked hackers leveraged known security flaws in outdated Internet routers to mass-harvest Microsoft Office authentication tokens. By exploiting these router vulnerabilities, the attackers intercepted tokens from users across more than 18,000 networks without installing malware. This approach allowed stealthy credential theft facilitating unauthorized access to Microsoft Office services. The attack vector centers on router weaknesses rather than direct compromise of Microsoft infrastructure or endpoint devices.

The impact involves unauthorized access to Microsoft Office accounts through stolen authentication tokens, potentially leading to data exposure or account misuse. However, the exploitation depends on vulnerable older routers, limiting the scope to networks still using such devices. There is no indication of malware infection or broader system compromise. The campaign affected a significant number of networks but is constrained by the prerequisite of router vulnerabilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations should ensure that Internet routers are updated with the latest firmware to remediate known vulnerabilities. Replacing outdated routers and implementing network segmentation can reduce exposure. Additionally, enabling multi-factor authentication on Microsoft Office accounts can mitigate risks from stolen tokens. Since no vendor advisory or official fix details are provided, monitoring for updates from router manufacturers and Microsoft is recommended.