DNS Poisoning Attacks: How Network-Edge Hijacking Works

The Domain Name System (DNS) is a crucial trust mechanism for internet connections. It translates domain names, such as Google or McDonald’s, into IP addresses devices use to find websites and other online resources. When that process is manipulated through a DNS poisoning attack, users can be sent somewhere entirely different without noticing anything unusual in the address they entered.

That risk came into focus in a recent campaign targeting hotel and conference Wi-Fi networks. Attackers poisoned DNS responses at the network edge, redirecting users toward malicious login pages designed to steal credentials. Rather than compromising each device individually, the operators targeted shared infrastructure and used its trusted position to influence traffic across the network.

The campaign shows why a DNS poisoning attack remains a practical threat. This article examines how network-edge hijacking works, what recent activity reveals about the attackers using it and how organizations can reduce their exposure.

What is DNS Poisoning?

DNS poisoning is the manipulation of the Domain Name System so that a device stores or accepts false information about where a domain should resolve. As a result, a user can enter the correct web address but be directed to an attacker-controlled server.

The false entry may be inserted into a DNS cache, supplied by a malicious resolver or introduced through compromised network equipment. Once accepted, it can affect multiple requests and, in some cases, multiple users relying on the same DNS infrastructure.

Poisoning is the overall act of maliciously interfering with DNS settings, but there are separate terms that describe different parts of the attack:

• DNS spoofing is the act of forging a DNS response or impersonating a trusted DNS server.
• DNS hijacking occurs when attackers take control of how queries are handled. This includes changing router settings, replacing legitimate DNS resolvers, or intercepting DNS requests.
• Domain hijacking involves taking control of a domain registration account or changing authoritative DNS records. Rather than manipulating traffic locally, the attacker alters the legitimate source of DNS information.

DNS Poisoning Attacks Target Hotel and Conference Wi-Fi

In July 2026, ReliaQuest reported a DNS poisoning campaign affecting Wi-Fi gateways at hospitality venues. The activity had been underway since at least June and was observed across several US cities, as well as locations in India and Saudi Arabia.

The attackers targeted captive portal appliances, in particular the gateways that manage guest access and DNS for connected devices. ReliaQuest could not confirm the initial access method, but assessed with low-to-medium confidence that the operators exploited exposed management services alongside weak or reused administrator credentials.

Once they gained administrative control, the attackers changed how the gateways handled DNS requests. Devices joining the Wi-Fi network accepted the gateway as their DNS resolver, allowing it to return attacker-controlled IP addresses for legitimate domain queries. This meant the operators could redirect users without using phishing or compromising their device.

Credential Theft Without Phishing or Infostealers

ReliaQuest observed traffic being directed toward infrastructure hosting Microsoft 365 impersonation pages, with the apparent aim of compromising the accounts of traveling corporate employees.

Organizations seen connecting to affected gateways operated across financial services, legal, health care, energy, retail and other sectors. This suggests the attackers were targeting users opportunistically rather than focusing on one industry.

In some cases, the attackers attempted to abuse Web Proxy Auto-Discovery Protocol (WPAD), which could route application traffic through a malicious proxy. In a smaller number of cases, they paired DNS redirection with abuse of Microsoft’s device-code authentication flow, potentially allowing them to obtain valid OAuth tokens without stealing a password or bypassing MFA directly.

Links to FrostArmada

The hospitality campaign was unattributed, but its network-edge tactics resemble those used in FrostArmada, a DNS hijacking campaign linked to APT28, also known as Forest Blizzard and Fancy Bear.

Disclosed by Microsoft and the UK National Cyber Security Centre (NCSC) in April 2026, the campaign targeted vulnerable small-office and home-office (SOHO) routers rather than attempting to breach enterprise systems directly. Microsoft identified more than 5,000 affected devices and over 200 organizations communicating with the malicious infrastructure.

How APT28 Changed Router DNS Settings

After compromising a router, APT28 altered its DHCP configuration to assign an attacker-controlled DNS resolver to connected devices. Because laptops and phones typically obtain their network settings automatically, they inherited the malicious resolver without requiring any changes at the endpoint.

The NCSC identified TP-Link’s WR841N as one exploited model, likely compromised through CVE-2023-50224. The vulnerability could expose router credentials through a crafted HTTP request. The attackers could then submit another request that changed the router’s DNS settings.

This gave APT28 a scalable way to identify valuable targets before launching adversary-in-the-middle attacks. Microsoft observed follow-on activity against Outlook on the web, as well as AiTM activity against servers belonging to African government organizations. The campaign shows how compromised routers can support both passive intelligence gathering and selective interception while remaining outside normal endpoint monitoring.

How the Campaigns Compare

Feature	Hospitality Wi-Fi campaign	FrostArmada
Attribution	Unattributed	Linked to APT28 and Russia’s GRU
Compromised infrastructure	Captive portal appliances and public Wi-Fi gateways	Small-office and home-office routers
Targets	Users connecting to shared networks at hotels and conference centers	Users behind compromised residential and small-business routers
DNS technique	Gateway returned forged DNS responses directing traffic to attacker infrastructure	Router settings were changed to assign an attacker-controlled DNS resolver
Redirection pattern	ReliaQuest observed all DNS requests being directed to malicious infrastructure	DNS traffic was monitored broadly, with selected requests redirected
Primary services targeted	Microsoft 365 authentication	Outlook and other web and email services

The Strongest Links Between the Campaigns

The clearest connection is the choice of attack position. Both campaigns targeted devices that sit between users and the wider internet. Once compromised, those devices could supply malicious DNS information to every client that trusted their network configuration.

Both campaigns also focused on Microsoft authentication. The hospitality operation redirected users toward Microsoft 365-themed infrastructure, while FrostArmada selectively intercepted traffic to Outlook-related domains. In each case, manipulating DNS created a route to credentials or authentication tokens.

There is also a shared emphasis on avoiding direct endpoint compromise. The attackers did not need to install malware on every laptop behind a router or connected to a hotel network. By controlling the gateway or resolver, they could operate outside many of the defenses deployed on corporate endpoints.

Important Differences Weaken the Attribution Case

FrostArmada used compromised SOHO routers as large-scale observation points, forwarding most queries normally and redirecting only traffic that met the attackers’ criteria. The NCSC assessed that APT28 was probably filtering a broad pool of victims to identify users with intelligence value.

ReliaQuest reported a less selective pattern in the hospitality campaign: all DNS requests were resolved to malicious infrastructure. That approach creates more noise and increases the likelihood of discovery.

The campaigns also used different infrastructure, and the hospitality activity introduced techniques not documented in FrostArmada, including attempted WPAD abuse and device-code authentication abuse.

The evidence therefore supports a link at the level of tactics rather than attribution. Based on the available research, attributing the campaign to APT28 would go beyond what the technical evidence supports.

How to Prevent DNS Poisoning Leading to Account Takeover

An employee connecting to a public Wi-Fi network has no visibility into whether that router is compromised. However, there are several measures that can protect employee devices and prevent a poisoned router leading to a successful account takeover.

Use a VPN for public network connections: A full-tunnel VPN prevents attacks of this nature. VPNs route all traffic, including DNS, through the corporate network.

Do not treat MFA as the finish line: Attackers can abuse legitimate authentication flows to obtain valid sessions without stealing an MFA code.

Bind access to approved devices: Use Zero Trust controls to verify that sign-ins come from recognized, compliant endpoints.

Check device posture continuously: Access decisions should account for security status, not just whether the user supplied valid credentials or approved a prompt.

Strengthen password defenses: Enforce strong password policies and continuously monitor for credentials exposed in data breaches.

How Specops Helps

These DNS poisoning campaigns demonstrate why MFA alone is no longer sufficient to ensure account security. By manipulating trusted Wi-Fi infrastructure and abusing Microsoft’s device-code flow, attackers can obtain a legitimate session without stealing a password or intercepting an MFA code.

Organizations need to secure workforce access with a Zero Trust approach that binds identities to approved devices. Specops Device Trust authenticates users and devices at every access point, continuously verifying device identity and security posture. This means that even if a user is tricked into authorizing an attacker-initiated session, our solution can deny access from an unrecognized or non-compliant device.

Strong password policies and continuous breached-password monitoring provide another layer of protection when credentials are captured. Specops Password Policy with Breached Password Protection delivers that assurance, continuously blocking over 6 billion unique compromised passwords and simplifying policy management.

If you’re interested in seeing how Specops can help strengthen your identity security with Zero Trust principles, book a demo today.