State-backed Russian hackers quietly harvested Microsoft Office authentication tokens from more than 18,000 business networks by exploiting known vulnerabilities in old routers — no malware required. If your office still runs routers with firmware that hasn’t been updated, your Microsoft 365 accounts may already be exposed.

what is a network security audit

What Happened: 18,000 Networks, Zero Malware

Security researcher Brian Krebs reported this week that Russian military intelligence units — linked to GRU-affiliated threat groups — ran a campaign specifically targeting businesses still operating legacy router hardware. The technique exploited firmware-level vulnerabilities present in older models from multiple manufacturers.

What makes this attack unusual — and particularly dangerous — is the method. The attackers did not deploy ransomware, did not phish individual employees, and did not install any software on victim systems. Instead, they leveraged architectural weaknesses in outdated router firmware that caused the devices to leak Microsoft Office session tokens: the cryptographic keys that prove a user is already authenticated.

Once an attacker holds your authentication token, they don’t need your password. They can access your Microsoft 365 email, SharePoint files, Teams conversations, and OneDrive storage — silently, from anywhere in the world.

The scale — 18,000 networks — tells you this was not a targeted espionage operation. It was an indiscriminate sweep, collecting tokens from any business running a vulnerable router.

Why Legacy Routers Are a Business-Level Risk in 2026

Most businesses treat their router as a utility — like a light switch. It works, so nobody touches it. The result is that many offices are running routers with firmware that is two, four, or even eight years out of date. Manufacturers release security patches; those patches never get applied; the vulnerabilities accumulate.

Legacy router models — particularly those released before 2022 — frequently contain unresolved security issues in how they handle session management and traffic inspection. In the Russian campaign, these flaws allowed the devices to expose authentication tokens that passed through the network, even on HTTPS-encrypted traffic in some configurations.

According to Krebs’s reporting, no CVE identifier was cited for this specific attack vector, which suggests the exploit may be targeting multiple known weaknesses in combination rather than a single, catalogued flaw. This is significant: it means there is no single patch to apply. The fix is firmware updates across your entire router fleet — or replacement of devices that no longer receive manufacturer support.

The Business Impact of Stolen Authentication Tokens

Authentication token theft is categorically worse than password theft for one reason: tokens typically bypass multi-factor authentication. When you log into Microsoft 365, MFA challenges your password and then issues a token confirming your identity. If an attacker steals that token before it expires, they skip the MFA step entirely and access your account as if they were you.

For a typical small or midsize business, this translates directly to:

Email access. Attackers can read, forward, and delete your email — including vendor invoices, client communications, and internal financial discussions — without triggering standard security alerts.

File access. SharePoint and OneDrive files become readable and downloadable. If your business stores contracts, HR records, or client data in Microsoft 365, that data is now in hostile hands.

Teams infiltration. Attackers inside Teams can observe active projects, manipulate shared documents, and in some configurations send messages as the compromised user.

Credential pivoting. From a compromised Microsoft 365 account, attackers can often request password resets for connected services, expanding access beyond the initial token theft.

The regulatory implications compound the risk. Under GDPR, unauthorized access to personal data stored in Microsoft 365 triggers mandatory breach notification requirements, regardless of whether the business detected the intrusion. HIPAA-covered entities face similar obligations. A stolen token that goes undetected for weeks is not a minor IT issue — it’s a reportable breach.

GDPR breach notification requirements for small business

What To Do Right Now

1. Audit your router inventory today. Identify every router, access point, and network switch on your business premises. Document the manufacturer, model, and current firmware version. If you don’t know the firmware version, assume it’s outdated.

2. Apply firmware updates within 24 hours. Go to the manufacturer’s support page for each device and download the latest firmware. Most modern routers allow updates through a web-based management interface. Priority devices: any router with internet-facing management access, all office perimeter routers, and any devices purchased before 2022.

3. Retire unsupported hardware. If a router’s manufacturer no longer releases firmware updates, it is a liability. No patch will protect it. Replace it. Modern business-grade routers from Cisco, Fortinet, or Ubiquiti cost between $150 and $800 for most SMB deployments — far less than the cost of a breach investigation.

4. Enforce short token expiration in Microsoft 365. In the Microsoft Entra (Azure Active Directory) admin center, reduce session token lifetime from the default to 1–4 hours. This limits the window an attacker has to use a stolen token. Combined with Conditional Access policies, this significantly raises the cost of token-based attacks.

5. Enable Continuous Access Evaluation (CAE). Microsoft’s CAE feature allows 365 services to revoke sessions in near real-time when a risk signal is detected. Enable it in your Entra admin settings. It won’t stop token theft at the router level, but it reduces the damage window significantly.

6. Segment your network. Separate the network segment that routes Microsoft 365 traffic from other internal traffic. If a legacy router must remain in use temporarily, ensure it handles only non-sensitive traffic while you arrange replacement.

business network segmentation guide