Midnight Blizzard (APT29) Targets Travelers via Hotel Wi-Fi

Originally published on CyberNetSec.

Executive Summary

Microsoft Threat Intelligence has identified a global espionage campaign named "CaptiveCrunch" orchestrated by Midnight Blizzard (also known as APT29 or Cozy Bear), a threat actor linked to Russia's Foreign Intelligence Service (SVR). The campaign targets corporate travelers by compromising Wi-Fi captive portals at hotels and other hospitality venues. Attackers intercept network traffic to deliver custom malware, including the CornFlake RAT and ChocoShell infostealer, with the primary objective of stealing corporate credentials and gaining persistent access to target networks. The sophistication of the attack, which includes device code phishing to bypass MFA, poses a significant risk to organizations with employees who travel frequently.

Threat Overview

The threat actor, tracked by Microsoft as Storm-2945 (a sub-cluster of Midnight Blizzard), has been active since at least May 2026. The attack vector involves compromising guest Wi-Fi networks at hotels, conference centers, and airports. By manipulating DNS and HTTP traffic on these networks, the attackers perform an adversary-in-the-middle (AitM) attack. When a traveler connects to the compromised Wi-Fi, they are redirected through attacker-controlled infrastructure. They are then presented with a malicious prompt disguised as a legitimate software update for their browser or operating system, which appears as a normal part of the Wi-Fi connection process. Since July 16, 2026, the attackers have incorporated a device code phishing technique, tricking users into entering a code on a legitimate Microsoft sign-in page, which grants the attackers an MFA-satisfied session token for the user's corporate Microsoft 365 account.

Technical Analysis

The attack chain relies on social engineering and network interception. The core of the operation is the delivery of a two-stage malware payload managed by a C2 panel named FruitStone.

• Initial Access & Interception: The attackers compromise hotel network infrastructure to control the captive portal experience. This allows them to intercept all traffic from a victim's device, a technique known as T1557 - Adversary-in-the-Middle.
• Malware Delivery: Through a fake update prompt, the victim is tricked into downloading and executing the initial payload.
• Malware Stage 1 - CornFlake: A remote access trojan (RAT) written in Go. It establishes persistence by registering itself as a Windows service named Cloud Sync Service. Its capabilities include capturing screenshots (T1113 - Screen Capture), recording clipboard content (T1115 - Clipboard Data), and stealing browser data (T1555.003 - Credentials from Web Browsers).
• Malware Stage 2 - ChocoShell: An in-memory PowerShell infostealer (T1059.001 - PowerShell). It is designed to steal a wide range of credentials, including Microsoft 365 and Azure AD tokens (T1539 - Steal Web Session Cookie). It also contains modules to bypass Chrome's App-Bound Encryption and disable Windows Defender updates.

Impact Assessment

The "CaptiveCrunch" campaign poses a severe threat to organizations across all sectors, particularly those with employees who handle sensitive information and travel for business. The primary impact is corporate espionage through the theft of sensitive data and intellectual property. Compromise of a corporate account, especially with an MFA-satisfied token, can provide attackers with deep and persistent access to an organization's cloud environment, email systems, and internal documents. This can lead to significant financial loss, reputational damage, and regulatory penalties.

IOCs — Directly from Articles

No specific file hashes, domains, or IP addresses were mentioned in the source articles.

Cyber Observables — Hunting Hints

Security teams may want to hunt for the following patterns which could indicate related activity:

Type	Value	Description
Process Name	cornflake.exe	Potential name of the CornFlake RAT executable.
Service Name	Cloud Sync Service	Persistence mechanism used by the CornFlake RAT.
Command Line Pattern	powershell.exe -enc -nop -w hidden	Common pattern for executing encoded, in-memory PowerShell scripts like ChocoShell.
Network Traffic Pattern	Unusual DNS queries or HTTP redirects on guest/public Wi-Fi networks.	Could indicate captive portal manipulation.
Log Source	Windows Security Event Log (ID 4688)	Monitor for suspicious PowerShell execution and service creation (Event ID 7045).

Detection & Response

Detecting this threat requires a multi-layered approach focusing on endpoint, network, and identity signals.

1. Endpoint Detection (EDR): Deploy EDR solutions to monitor for the creation of suspicious services, especially those named Cloud Sync Service. Create detection rules for in-memory PowerShell execution, particularly scripts that attempt to access credential stores or disable security features. D3FEND's Process Analysis (D3-PA) is key here.
2. Network Monitoring: While on corporate networks, monitor for outbound connections to unknown C2 infrastructure. For remote users, client-side VPNs with kill-switch capabilities can prevent leakage.
3. Identity & Access Management: Monitor Azure AD sign-in logs for suspicious activity, such as logins from unexpected locations or anomalous token issuance events, especially via device code flow. Implement conditional access policies that restrict or require step-up authentication for risky sign-ins. D3FEND's User Geolocation Logon Pattern Analysis (D3-UGLPA) can help identify anomalous access patterns.

Mitigation

Organizations should assume public Wi-Fi networks are untrustworthy and implement the following controls:

1. User Training: Educate employees, especially travelers, about the risks of public Wi-Fi and social engineering tactics like fake update prompts. This aligns with MITRE's User Training (M1017).
2. VPN Usage: Enforce the use of a corporate VPN for all internet traffic when employees are on untrusted networks. Ensure the VPN client has a "kill switch" feature to block all traffic if the VPN connection drops.
3. Use Cellular Hotspots: Encourage or provide employees with cellular hotspots (e.g., 5G) as a more secure alternative to public Wi-Fi.
4. Endpoint Hardening: Implement application control policies to prevent the execution of unauthorized software. Keep browsers and operating systems fully patched. This corresponds to D3FEND's Application Hardening (D3-AH).
5. Multi-Factor Authentication (MFA): While this attack attempts to bypass MFA, using phishing-resistant MFA methods (like FIDO2 security keys) is still a critical defense. This aligns with MITRE's Multi-factor Authentication (M1032).