# CaptiveCrunch: Midnight Blizzard (Storm-2945) Hospitality Captive-Portal AiTM Campaign

> Microsoft Threat Intelligence attributes CaptiveCrunch to Storm-2945, a sub-cluster of Russia's SVR-linked Midnight Blizzard, active since early May 2026. The actor compromises captive-portal gateways at hotels and conference venues, forges DNS/HTTP responses to push corporate travelers to Microsoft Entra device-code phishing and ClickFix/fake-update lures, and delivers the CornFlake RAT and ChocoShell infostealer, run from the FruitStone operator panel.

- **Published:** 2026-07-31T00:00:00Z
- **Last reviewed:** 2026-07-31T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2765
- **ID:** TL-2026-2765
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** UNC2452 (Russia)
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)

## Description

CaptiveCrunch is a cyber-espionage campaign that Microsoft Threat Intelligence attributes to Storm-2945, a sub-cluster of Midnight Blizzard (APT29 / NOBELIUM), the threat actor tied to Russia's Foreign Intelligence Service (SVR). Microsoft reports the campaign has manipulated DNS/HTTP traffic since early May 2026 and published its findings on 2026-07-31, following a ReliaQuest report of 2026-07-23 that documented DNS poisoning on hospitality Wi-Fi and first compared it to FrostArmada (APT28) before Microsoft's attribution. Microsoft notes earlier device-code/OAuth phishing operations from February 2026 and technical overlap with the Storm-2372 device-code cluster.

Initial position: the actor controls captive-portal gateways at hotels, conference centers and other shared venues. On the networks ReliaQuest investigated, the gateway also served as the DNS resolver handed to clients, so administrative control let the actor forge DNS answers and redirect traffic without touching the victim device. ReliaQuest suspects exploitation of exposed management interfaces (SSH, SNMP, web administration) combined with weak credentials, and observed WPAD abuse. Microsoft states the initial compromise vector for the portals is still under investigation; commonalities in equipment and management systems suggest shared service access rather than isolated compromises. Victim venues reported by ReliaQuest span multiple US cities, India and Saudi Arabia (hotels, conference centers, airports, co-working spaces, universities, healthcare facilities), and targeted users came from financial services, professional services, legal, healthcare, energy and retail.

User-facing lures: connectivity-check (NCSI/captive-detection) requests are redirected to fake browser or OS updates and to ClickFix pages (fake Windows Driver Repair Utility, verification-failure prompts, instructions to run commands via Windows Terminal); Android variants instruct APK download. Since 2026-07-16 some landing pages redirect guests into Microsoft's legitimate device-code sign-in flow, so entering the actor-supplied code grants the actor's session MFA-satisfied access. AiTM infrastructure uses look-alike Microsoft 365/OWA domains. Infection is not silent: the victim must download or execute the payload.

Malware: CornFlake is a Go Windows RAT that installs to %APPDATA%\svchost32\svchost32.exe and registers a service (display name 'Cloud Sync Service'), plus Run-key and scheduled-task persistence with a watchdog. It uses ECDH P-256 key exchange with SHA-256-derived session keys over a custom JSON protocol, and supports keylogging, clipboard monitoring, screenshots, microphone and webcam capture, a ChromeKatz-derived browser credential stealer (Chrome App-Bound Encryption bypass, Firefox NSS decryption), extension-based file exfiltration (up to 1,000 files / 500MB per cycle), USB monitoring, an 18-category security posture sweep, a remote shell, and a localhost HTTP API (/upload, /reload, /status) with hot reconfiguration through sync.dat. ChocoShell is an in-memory PowerShell infostealer that disables AMSI via .NET reflection, exits on timing-based VM checks, tries three silent UAC bypasses (SilentCleanup windir hijack, wsreset.exe COM hijack, sdclt.exe folder hijack) with a visible RunAs fallback, and steals Chromium/Firefox cookies and passwords, Wi-Fi keys and M365 Token Broker .tbres tokens for session replay. It beacons to 213.145.86.112 over HTTPS using tracking-pixel-style URIs (/t/pixel.gif?m=<status>), fetches its payload from /cdn/chunks/polyfill-7e2b.min.js and exfiltrates GZip+Base64 JSON to /t/event. FruitStone is the operator SPA branded 'CloudSync Console': JWT multi-operator auth, SSE agent dashboard, remote shell and file browser, a four-step campaign/dropper builder with evasion options, proxy relays, beacon profiles with SNI spoofing (teams.microsoft.com) and staging servers. Microsoft assesses the actor uses AI to support a significant portion of operations (ChocoShell comments suggest AI-assisted code); Anthropic and OpenAI collaborated on the investigation.

Defender relevance: corporate travelers on untrusted Wi-Fi are the exposure. Priority controls are always-on full-tunnel VPN with corporate DNS, blocking device-code flow via Conditional Access, phishing-resistant MFA, refusing updates or tools offered through captive portals, and hunting for the published IOCs and the svchost32 service artifacts. No CVE is cited by the sources.

## MITRE ATT&CK

- T1583.001 Domains
- T1584.008 Network Devices
- T1566.002 Spearphishing Link
- T1204.004 Malicious Copy and Paste
- T1059.001 PowerShell
- T1543.003 Windows Service
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1548.002 Bypass User Account Control
- T1546.015 Component Object Model Hijacking
- T1685 Disable or Modify Tools
- T1497.003 Time Based Checks
- T1557 Adversary-in-the-Middle
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1528 Steal Application Access Token
- T1056.001 Keylogging
- T1550.001 Application Access Token
- T1113 Screen Capture
- T1123 Audio Capture
- T1125 Video Capture
- T1071.001 Web Protocols
- T1573.002 Asymmetric Cryptography
- T1020 Automated Exfiltration

## Sources

- [CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft (Microsoft Security Blog)](https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/)
- [CaptiveCrunch: Midnight Blizzard Hospitality Network AiTM Campaign (Wiz Threats)](https://threats.wiz.io/all-incidents/captivecrunch-midnight-blizzard-hospitality-network-aitm-campaign)
- [DNS Poisoning Tactics Expand to Hospitality Wi-Fi (ReliaQuest Threat Spotlight)](https://reliaquest.com/blog/threat-spotlight-dns-poisoning-tactics-expand-to-hospitality/)
- [Russian State APT Linked to Recent Public Wi-Fi Gateway Hacking (SecurityWeek)](https://www.securityweek.com/russian-state-apt-linked-to-recent-public-wi-fi-gateway-hacking/)
- [Hijacked Hotel Wi-Fi Pushes Fake Updates to Deliver Surveillance Malware (The Hacker News)](https://thehackernews.com/2026/08/hijacked-hotel-wi-fi-pushes-fake.html)
- [Russian hackers abuse hotel Wi-Fi networks to steal Microsoft 365 credentials and deploy malware (Help Net Security)](https://www.helpnetsecurity.com/2026/08/04/midnight-blizzard-hotel-wi-fi-networks-hacking/)
- [Midnight Blizzard Targets Travelers via Captive Portals (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/captivecrunch-midnight-blizzard/)
- [Russian spies turn public Wi-Fi into malware delivery systems (The Register)](https://www.theregister.com/security/2026/08/03/russias-svr-borks-public-wi-fis-for-digital-surveillance/5282399)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2765