Full Report
Microsoft has linked a global campaign targeting hospitality Wi-Fi networks to the Russian threat actor Midnight Blizzard, also known as APT29. [...]
Analysis Summary
# Threat Actor: Midnight Blizzard (APT29)
## Attribution & Identity
* **Name:** Midnight Blizzard
* **Aliases:** APT29, Cozy Bear, NOBELIUM, Storm-2945 (sub-cluster)
* **Associated State:** Russia
* **Reported Associations:** Foreign Intelligence Service of the Russian Federation (SVR)
## Activity Summary
According to the Microsoft report, Midnight Blizzard has been conducting a campaign dubbed **CaptiveCrunch** since at least May 2026 (with preliminary operations starting in February). The campaign targets travelers by compromising hospitality Wi-Fi networks and captive portals in hotels and conference centers globally to deliver custom malware and steal credentials.
## Tactics, Techniques & Procedures
* **Initial Access:** Manipulation of DNS and HTTP traffic on captive portal equipment; exploitation of shared infrastructure.
* **Phishing & Social Engineering:**
* Impersonation of Microsoft 365 login portals.
* **Device Code Phishing:** Abusing Microsoft Entra ID authentication flows.
* **ClickFix:** Using fake browser/OS update prompts and "user verification" windows to deliver malware.
* **Persistence:**
* Windows service registrations, registry run keys, and scheduled tasks.
* Watchdog routines to restore deleted persistence mechanisms.
* Disguising as "Cloud Sync Service."
* **Execution & Stealing:**
* Go-based Remote Access Trojans (RAT).
* In-memory PowerShell scripts for credential harvesting.
* AI-assisted code development.
* **Exfiltration:** Harvesting browser cookies, session tokens (M365/Azure AD), keylogging, and screen/media capture.
## Targeting
* **Sectors:** Hospitality, Travel, Corporate (traveling employees), and Government.
* **Geography:** Global / Worldwide.
* **Victims:** Users of hotel and conference center Wi-Fi networks; targets include Windows and potentially Android devices.
## Tools & Infrastructure
* **CornFlake:** A Go-based RAT capable of remote shell access, keylogging, file exfiltration, and surveillance (mic/webcam).
* **ChocoShell:** An in-memory PowerShell credential stealer targeting M365/Azure tokens and Wi-Fi credentials.
* **FruitStone:** An unprotected web-based management panel used for C2 operations, including file browsing and keystroke capture.
* **Payload Delivery:** APK files (Android) and various fake installers/update binaries (Windows).
## Implications
This campaign demonstrates a sophisticated shift toward targeting "transition" environments where users are likely to lower their guard. By compromising the underlying network infrastructure (DNS/Captive Portals), the actor bypasses traditional endpoint-to-server encryption trust, allowing for highly effective credential theft and session hijacking. The use of AI-assisted malware development suggests an increased tempo in creating custom, evasive tools.
## Mitigations
* **Network Security:** Treat all public/hotel Wi-Fi as untrusted. Use VPNs or private cellular hotspots (5G/LTE) whenever possible.
* **Authentication:** Implement phishing-resistant Multi-Factor Authentication (MFA) and passkeys.
* **Entra ID Configuration:** Disable Microsoft Entra device code authentication flows if they are not strictly required for business operations.
* **User Hygiene:**
* Do not use corporate credentials to register for guest Wi-Fi.
* Avoid downloading any software updates, drivers, or "diagnostic tools" prompted by a captive portal or public network.
* **Endpoint Defense:** Monitor for unusual PowerShell activity and unauthorized changes to DNS settings or Windows Service registrations.