Actor Profile

Storm-2945 is assessed by Microsoft to be an operational sub-cluster of Midnight Blizzard (APT29, Cozy Bear), which the U.S. and U.K. governments attribute to Russia's Foreign Intelligence Service (SVR). The U.K. National Cyber Security Centre assesses with high confidence that APT29 is almost certainly part of the SVR. Storm-2945 conducts cyber espionage operations targeting hospitality networks to compromise travelers' devices. The CaptiveCrunch campaign demonstrates sophisticated network-layer manipulation tradecraft that resembles APT28 router hijacking techniques disclosed by Microsoft in April 2026, though Microsoft attributes this specific operation to the Storm-2945 sub-cluster. The initial compromise vector for the hotel network infrastructure remains under investigation, with low-to-medium confidence assessment pointing to exposed management interfaces and weak credentials.

TTPs (Tactics, Techniques, Procedures)

The CaptiveCrunch campaign leverages compromised hotel captive portal gateways to conduct DNS spoofing attacks, redirecting automatic connectivity checks to fake browser or OS update pages. The operation employs social engineering via ClickFix instructions that trick victims into executing attacker-supplied commands in Windows utilities (T1204.002 User Execution: Malicious File). CornFlake RAT establishes persistence through Registry Run keys (T1547.001 Boot or Logon Autostart Execution: Registry Run Keys) and scheduled tasks, with a watchdog mechanism to restore removed persistence. The malware performs credential theft targeting browser cookies including Chrome App-Bound Encryption protections, saved passwords, and clipboard contents (T1555 Credentials from Password Stores, T1115 Clipboard Data). It conducts collection activities including webcam capture, microphone recording, idle-triggered screenshots (T1113 Screen Capture), and removable media scanning (T1025 Data from Removable Media). ChocoShell stealer harvests Microsoft 365, Azure AD, and Web Account Manager tokens from Token Broker cache files (T1528 Steal Application Access Token, T1539 Steal Web Session Cookie). Since July 16, 2026, the campaign has incorporated Microsoft device code authentication flow abuse to obtain MFA-satisfied access tokens.

Targets & Patterns

Storm-2945 specifically targets the hospitality sector, compromising hotel Wi-Fi networks across multiple countries since early May 2026. The targeting pattern suggests strategic interest in travelers who connect to hotel networks, likely for espionage purposes consistent with SVR intelligence collection priorities. Microsoft identified common equipment and management systems across affected networks, suggesting the threat actor may have gained access to shared services within portions of the captive portal ecosystem rather than compromising individual venues in isolation. This indicates potential supply chain or service provider compromise affecting multiple hospitality properties simultaneously. The campaign does not target specific organizations but rather opportunistically compromises any device connecting to the manipulated networks, with particular value placed on credentials and tokens that enable persistent access to corporate and cloud environments. The focus on business travelers aligns with traditional APT29 espionage objectives targeting government, diplomatic, and corporate entities.

Historical Context

Storm-2945 operates as a sub-cluster within the broader Midnight Blizzard (APT29) umbrella, which has extensive operational history dating to at least 2008. APT29 is known for malware families including PinchDuke, WellMail, CozyCar, TrailBlazer, OnionDuke, FatDuke, POSHSPY, EnvyScout, and SoreFang. The CaptiveCrunch campaign's network infrastructure manipulation tradecraft resembles APT28 (Forest Blizzard) router hijacking techniques that Microsoft disclosed in April 2026, though Microsoft maintains attribution to Storm-2945. ReliaQuest noted the TTP overlap with APT28 but stopped short of attribution due to lack of direct technical linkage. This suggests potential sharing of operational techniques between Russian intelligence units or deliberate tradecraft mimicry. The campaign represents an evolution in APT29 initial access methods, moving from traditional phishing and supply chain attacks to network-layer manipulation of hospitality infrastructure. The incorporation of device code authentication flow abuse since July 16, 2026, demonstrates rapid adaptation to cloud authentication mechanisms.

Defensive Recommendations

  • Deploy always-on, full-tunnel VPN solutions for traveling employees to route DNS queries through corporate resolvers before venue gateways can intercept them, preventing DNS spoofing attacks
  • Block Microsoft device code authentication flow via Conditional Access policies in environments where it is not operationally required to prevent MFA-satisfied token theft
  • Implement endpoint detection rules for suspicious service creation matching CornFlake indicators: svchost32 service with display name 'Cloud Sync Service' and executable path %APPDATA%\svchost32\svchost32.exe
  • Monitor for unauthorized access to Token Broker cache .tbres files and unusual PowerShell execution targeting credential stores (T1555, T1528, T1539)
  • Establish user awareness training instructing travelers to reject all software updates, certificates, browser updates, or security utilities offered through captive portals and public Wi-Fi networks