Full Report
Microsoft Threat Intelligence identified CaptiveCrunch, an ongoing cyberespionage campaign conducted by Storm-2945, a subgroup of the Russian state-sponsored actor Midnight Blizzard. The campaign compromises hospitality-sector captive portal infrastructure to perform adversary...
Analysis Summary
# Threat Actor: Midnight Blizzard (Storm-2945)
## Attribution & Identity
* **Actor Name:** Midnight Blizzard (formerly known as Nobelium / APT29 / Cozy Bear).
* **Subgroup:** Storm-2945.
* **Attribution:** Russian state-sponsored threat actor.
* **Identity:** A sophisticated espionage group often associated with Russia's Foreign Intelligence Service (SVR).
## Activity Summary
* **Campaign Name:** CaptiveCrunch.
* **Overview:** An ongoing cyberespionage campaign targeting the hospitality sector's network infrastructure. The operation utilizes Adversary-in-the-Middle (AiTM) techniques to target travelers by compromising captive portals (guest Wi-Fi login pages) to steal credentials and deploy malware.
## Tactics, Techniques & Procedures
* **Initial Access:** Exploitation of web vulnerabilities in captive portal infrastructure.
* **Adversary-in-the-Middle (AiTM):** Manipulation of DNS and HTTP traffic to redirect users.
* **Credential Theft:** Use of phishing pages and fraudulent Microsoft Entra (Azure AD) device code authentication prompts to hijack Microsoft 365 sessions.
* **Persistence & Execution:** Deployment of remote access trojans (RATs) and PowerShell-based stealers.
* **Data Exfiltration:** Stealing browser credentials, SSO/Azure AD tokens, Wi-Fi credentials, and sensitive documents.
* **Surveillance:** Capturing screenshots, audio, video, and keystrokes.
* **AI Integration:** Use of Artificial Intelligence to support malware development and operational activities.
**MITRE ATT&CK Techniques:**
* Phishing (T1566)
* Adversary-in-the-Middle (T1557)
* DNS/HTTP Traffic Manipulation (T1557.002)
* Command and Scripting Interpreter: PowerShell (T1059.001)
## Targeting
* **Sectors:** Hospitality (Hotels, Airports, Conference Centers).
* **Geography:** Worldwide/Global travelers.
* **Victims:** Travelers/Guest users utilizing compromised hospitality-sector Wi-Fi networks; Microsoft 365 and Azure Entra ID users.
## Tools & Infrastructure
* **CornFlake:** A Remote Access Trojan (RAT) used for persistence and remote command execution.
* **ChocoShell:** A PowerShell-based infostealer.
* **FruitStone:** Mentioned tool associated with the campaign's ecosystem.
* **Infrastructure:** Malicious redirection servers and C2 infrastructure (specific IPs/URLs defanged in original source: `hxxps[://]www[.]microsoft[.]com/en-us/security/blog/2026/07/31/captivecrunch...`).
## Implications
This campaign demonstrates a high level of sophistication by targeting the "trust boundary" of hospitality Wi-Fi. By compromising the underlying infrastructure rather than just the end-user, the actor can bypass many traditional perimeter defenses. The use of AI in malware development suggests an increasing capability for rapid tool iteration and operational scaling.
## Mitigations
* **For Organizations/Travelers:**
* Utilize VPNs (Virtual Private Networks) when connecting to public or hospitality Wi-Fi to encrypt traffic.
* Implement and enforce Phishing-resistant Multi-Factor Authentication (MFA), such as FIDO2 security keys.
* Train employees to recognize suspicious device code authentication prompts.
* **For Hospitality Providers:**
* Regularly patch and audit captive portal software and network gateway hardware.
* Monitor for unauthorized changes to DNS configurations or unusual HTTP redirection rules.
* **Technical Defense:**
* Monitor for the execution of unauthorized PowerShell scripts (associated with ChocoShell).
* Audit Entra ID (Azure AD) sign-in logs for unusual device registration or session hijacking indicators.