Microsoft Threat Intelligence disclosed that Chinese espionage group Storm-0940 weaponized CovertNetwork-1658—a botnet of compromised SOHO routers and VPN gateways tracked as Quad7 (or xlogin)—for distributed credential harvesting. Adversaries hijacked edge appliances, primarily TP-Link, ASUS, Ruckus, and Zyxel systems, by exploiting known edge vulnerabilities and weak administrative interfaces. The operators deployed custom Telnet backdoors listening on TCP port 7777 alongside SOCKS5 proxies and KCP-based UDP tunnels, turning consumer edge devices into an evasive residential egress network.

Storm-0940 routed stealthy password-spraying campaigns through this pool against Microsoft Entra ID and Microsoft 365 tenants across government, defense, and think-tank targets in North America and Europe. To defeat automated account lockout thresholds and IP reputation heuristics, the botnet throttled authentication attempts, restricting roughly 80% of targets to a single login attempt per account per day. Harvested credentials granted initial tenant access, enabling downstream operators to abuse OAuth enterprise applications, dump directory credentials, and establish persistent lateral footholds.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Relaying authentication traffic through compromised residential routers breaks geolocation anomaly scoring and CIDR-based firewall blocks, while sub-threshold single-attempt spray cadences bypass tenant lockout policies and brute-force detection logic.
• Bullet 2 — Strategic & Defender Imperative: Organizations must transition from legacy password authentication to phishing-resistant FIDO2 MFA, enforce Entra Conditional Access policies requiring compliant managed devices, and monitor token issuance anomalies stemming from high-trust OAuth application registrations.