Forest Blizzard gained access to SOHO devices then altered their default network configurations to use actor-controlled DNS resolvers. This malicious re-configuration resulted in thousands of devices sending their DNS requests to actor-controlled servers. In most cases, the DNS requests appear to have been transparently proxied by the actor’s infrastructure, resulting in connections to the legitimate service endpoints without interruption. However, in a limited number of compromises, the threat actor spoofed DNS responses for specifically targeted domains to force impacted endpoints to connect to infrastructure controlled by the threat actor.
| Vendor | Product | Versions |
|---|---|---|
| tp-link | tl-wr841n_firmware | CVE-2023-50224 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| tp-link | tl-wr841n | cve_cpe | 95% |
Added a detailed description of the attack method and included new tags and IoCs related to the threat actor.
Updated severity to HIGH, CVSS estimate to 7.5, added new affected version CVE-2023-50224, and included new IoCs and tags related to the espionage operation.
Initial creation
