Microsoft Links CaptiveCrunch Wi-Fi Campaign to Russian APT29 Subgroup
Summary
Microsoft attributes CaptiveCrunch, a campaign manipulating captive-portal network traffic to steal credentials and deploy malware, to Storm-2945, a subgroup of Midnight Blizzard. It reports widespread Wi-Fi network compromises across several countries.
Key points
- ReliaQuest observed attackers modifying DNS settings on compromised SOHO routers to redirect users; Microsoft says the activity began manipulating DNS and HTTP traffic from captive-portal networks in May.
- Microsoft attributes the campaign, dubbed CaptiveCrunch, to Storm-2945, a subgroup of Midnight Blizzard, which it believes is sponsored by Russia's SVR.
- Microsoft reports widespread compromise of hospitality organizations' Wi-Fi networks and other networks served by captive-portal equipment in several countries.
- The campaign used adversary-in-the-middle techniques to target Microsoft 365 credentials and session tokens, including those of traveling employees across several sectors.
- Attackers used ClickFix lures and fake browser updates to deliver Windows malware; Microsoft also says similar methods appeared to target Android users with APK files.
- Reported malware included the CornFlake RAT and ChocoShell infostealer. CornFlake enabled reconnaissance, credential and session-token theft, file and keystroke collection, audio/video surveillance, and remote shell access.
- Some landing pages recently directed users to device-code authentication flows. Microsoft says this resembles Midnight Blizzard activity reported since August 2024, though its use alongside captive-portal manipulation may make the requests seem more legitimate.
Article Details
- Event Type
- Credential-theft and espionage campaign using compromised public Wi-Fi captive portal networks and DNS/HTTP traffic manipulation.
- Impact
- The campaign intercepted Microsoft 365 credentials and session tokens. Its malware enabled reconnaissance, file and keystroke collection, audio and video surveillance, and remote shell access. Microsoft reported widespread Wi-Fi network compromise at hospitality-related organizations and other networks using captive portal equipment in several countries.
Threat Actors
Cozy BearThe article identifies Cozy Bear as another tracking name for Midnight Blizzard, which Microsoft attributes as the parent group of the Storm-2945 subgroup involved in the campaign.ICE RELICThe article identifies APT29 as another tracking name for Midnight Blizzard, which Microsoft attributes as the parent group of the Storm-2945 subgroup involved in the campaign.Midnight BlizzardMicrosoft attributes the campaign to its subgroup Storm-2945. The article says Midnight Blizzard is also tracked as APT29, Cozy Bear, the Dukes, and Yttrium.Storm-2945Microsoft attributes the CaptiveCrunch campaign to Storm-2945 and describes it as a subgroup of Midnight Blizzard.the DukesThe article identifies the Dukes as another tracking name for Midnight Blizzard, which Microsoft attributes as the parent group of the Storm-2945 subgroup involved in the campaign.YttriumThe article identifies Yttrium as another tracking name for Midnight Blizzard, which Microsoft attributes as the parent group of the Storm-2945 subgroup involved in the campaign.
Malware
ChocoShellStorm-2945 targeted Windows users with the CornFlake RAT and infostealer implant and the ChocoShell PowerShell-based infostealer, and managed its infrastructure and agents via the FruitStone web-basedCornFlake RATStorm-2945 targeted Windows users with the CornFlake RAT and infostealer implant and the ChocoShell PowerShell-based infostealer, and managed its infrastructure and agents via the FruitStone web-based
Vendors
Products
Androidvarious ClickFix techniques to convince users to download malware and appears to have been targeting Android users with similar methods to entice them into fetching and installing an APK file.Microsoft 365 Apps for EnterpriseThe attackers were using the adversary-in-the-middle (AitM) technique to intercept the Microsoft 365 credentials of traveling employees within the financial services, professional services, legal, healthcare, energy,Microsoft WindowsAs part of CaptiveCrunch, the attackers have been serving Golang-based Windows remote access trojans (RATs) in the form of browser updates.
Tools
Industries
Energyof traveling employees within the financial services, professional services, legal, healthcare, energy, and retail sectors.Financial Services(AitM) technique to intercept the Microsoft 365 credentials of traveling employees within the financial services, professional services, legal, healthcare, energy, and retail sectors.Healthcare365 credentials of traveling employees within the financial services, professional services, legal, healthcare, energy, and retail sectors.Hospitality“To date, Microsoft has identified widespread compromise of Wi-Fi networks at hospitality-related organizations and other networks serviced by captive portal equipment in several countries,” the company notes.LegalMicrosoft 365 credentials of traveling employees within the financial services, professional services, legal, healthcare, energy, and retail sectors.Professional Servicesto intercept the Microsoft 365 credentials of traveling employees within the financial services, professional services, legal, healthcare, energy, and retail sectors.Retailtraveling employees within the financial services, professional services, legal, healthcare, energy, and retail sectors.