Post

Microsoft Threat Intelligence
@threatintel.microsoft.com

Storm-2945, a sub-cluster of Russian state actor Midnight Blizzard, has resumed their CaptiveCrunch campaign. msft.it/6019aWMDf First reported by Microsoft in July 2026, the campaign uses manipulated network traffic and captive portals in the hospitality sector to gain access to targets.

msft.itCaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft | Microsoft Security BlogStorm-2945, a sub-cluster of the Russian threat actor Midnight Blizzard, has been observed compromising the sign-in portals of hospitality-related organizations such as hotels since May 2026 in order to deliver malware to travelers and steal credentials in an operation we call CaptiveCrunch.
Microsoft Threat Intelligence
@threatintel.microsoft.com

The renewed activity is consistent with reporting from Black Lotus Labs suggesting that multiple managed service providers are implicated; Storm-2945’s continued access to these upstream providers has likely enabled this rapid re-deployment.

Microsoft Threat Intelligence
@threatintel.microsoft.com

We have updated our blog to provide more recent network infrastructure indicators, detections, and hunting guidance. We want to thank Google Threat Intelligence Group (GTIG) for their collaboration on tracking the reemergence of this activity.

0 reposts2 likes

No replies yet.