Full Report
Keyloggers, audio-visual surveillance, and token theft on CaptivePortal's agenda as hospitality sector put on alert
Analysis Summary
# Threat Actor: Storm-2945
## Attribution & Identity
**Storm-2945** is identified as a subdivision of the **SVR** (Russian Foreign Intelligence Service). It is associated with the broader threat group known as **Midnight Blizzard** (formerly Nobellium), the actors responsible for the SolarWinds supply chain attack.
## Activity Summary
Beginning in February 2026, Storm-2945 launched a campaign dubbed **"CaptiveCrunch."** The operation involves compromising captive portal networks (public Wi-Fi) to perform traffic manipulation. Since May 2026, the group has been observed using Adversary-in-the-Middle (AitM) positions to deliver infostealers and conduct credential theft against travelers and conference-goers.
## Tactics, Techniques & Procedures
- **Traffic Manipulation:** DNS poisoning and HTTP redirection to route users through attacker-controlled infrastructure.
- **Adversary-in-the-Middle (AitM):** Intercepting connectivity checks to trigger malicious prompts.
- **Social Engineering (ClickFix):** Using fake "OS update," "driver repair," or "web verification failure" prompts to trick users into installing malware.
- **Device Code Phishing:** Exploiting the OAuth device code flow to bypass Multi-Factor Authentication (MFA) and gain access to cloud environments.
- **In-Memory Execution:** Deploying payloads like ChocoShell entirely in-memory to evade traditional disk-based detection.
- **Post-Exploitation:** Audio/visual surveillance, keylogging, and browser session cookie theft.
## Targeting
- **Sectors:** Hospitality, conference centers, and shared public venues.
- **Geography:** Worldwide (targeting travelers).
- **Victims:** Windows and Android users connecting to public/hotel Wi-Fi; specifically targeting those with access to corporate cloud environments.
## Tools & Infrastructure
- **CornFlake:** A full-featured Windows Remote Access Trojan (RAT) used for persistence. It features a localhost HTTP API for modularity.
- **ChocoShell:** A PowerShell-based stealer delivered in-memory via CornFlake.
- **Malicious APKs:** Tailored ClickFix prompts targeting Android devices.
- **Infrastructure:** Attacker-controlled landing pages and C2 servers (specific IPs/URLs not listed in the text, but used for traffic rerouting).
## Implications
This campaign represents a strategic shift toward targeting the physical "last mile" of connectivity for high-value targets (traveling executives, government officials, and researchers). By compromising the network layer of hospitality venues, the SVR gains a high-trust environment to bypass MFA via device code phishing and deploy persistent surveillance tools on mobile workstations.
## Mitigations
- **Network Policy:** Organizations should disable the **Device Code Authentication flow** via Entra ID (formerly Azure AD) or other IDPs if not strictly required for the business.
- **Endpoint Security:** Implement robust EDR to detect in-memory PowerShell execution and unauthorized localhost API servers.
- **Connectivity:** Encourage the use of personal hotspots or satellite internet (e.g., Starlink) over public hospitality Wi-Fi.
- **User Training:** Educate staff to never download "system updates" or "browser patches" prompted specifically by a Wi-Fi login page or captive portal.
- **Identity:** Transition to Phishing-Resistant MFA (FIDO2/Passkeys), though noting that even these require vigilant monitoring against session/token theft.