Storm-2945 Deploys CornFlake RAT via CaptiveCrunch Campaign Targeting Global Hospitality Networks

Executive Summary

Microsoft Threat Intelligence (MSTIC) has identified a highly sophisticated campaign, tracked as "CaptiveCrunch," orchestrated by the threat actor Storm-2945, a sub-cluster of the Russian state-linked group Midnight Blizzard (APT29). This campaign focuses on manipulating DNS and HTTP traffic within hospitality sector networks, specifically targeting guests using captive portal Wi-Fi systems. The operation culminates in the deployment of a previously undocumented remote access trojan (RAT) dubbed "CornFlake," which grants attackers deep persistence and extensive surveillance capabilities over high-value targets. The activity marks a significant escalation in the actor's ability to intercept strategic communications from traveling executives and government personnel.

Threat Analysis

The CaptiveCrunch campaign represents a tactical shift for Midnight Blizzard, moving from traditional spear-phishing toward more opportunistic yet strategically placed network-level interceptions. By compromising the administrative gateways of hotel Wi-Fi networks, Storm-2945 places itself in a privileged position to intercept traffic from targets while they are in transit. The campaign has been active since early May 2026, with a significant spike in activity observed in late July 2026 across Europe and North America. The use of "ClickFix" social engineering—where victims are prompted to manually execute commands to "fix" a browser error—demonstrates an advanced understanding of human behavior under technical stress, effectively bypassing traditional automated defenses.

Technical Details

The attack chain begins when a user connects to a compromised hospitality Wi-Fi network. Storm-2945 gains administrative access to the captive portal gateway, which typically serves as the primary DNS resolver for connected clients. Using this control, the attackers forge DNS responses to redirect the client’s automatic connectivity checks (such as msftconnecttest.com) to an actor-controlled landing page. This page mimics a legitimate browser or operating system update notification.

The landing page utilizes a "ClickFix" lure, instructing the user to open a terminal (PowerShell or Command Prompt) and paste a provided Base64-encoded command to resolve a supposed "security certificate issue." When executed, this command downloads and installs the CornFlake RAT. CornFlake is a modular, Go-based malware family capable of capturing webcam images, audio from the system microphone, and logging keystrokes. It communicates with its Command and Control (C2) infrastructure using the Telegram API to blend in with standard HTTPS traffic. Recent variants have also been seen redirecting users to Microsoft device code authentication flows to hijack OAuth tokens and bypass Multi-Factor Authentication (MFA) via Entra device registration.

Attribution Assessment

Microsoft assesses with high confidence that Storm-2945 is an operational sub-cluster of Midnight Blizzard (APT29/Cozy Bear), which is attributed to Russia's Foreign Intelligence Service (SVR). This attribution is based on significant overlaps in infrastructure management, specific code signing patterns observed in the CornFlake RAT, and the strategic alignment of targeting travelers in the hospitality sector—a long-standing interest of SVR-linked entities for espionage purposes.

Implications

The CaptiveCrunch campaign highlights the persistent vulnerability of public and semi-public network infrastructure. For organizations, this means that even employees utilizing "trusted" hotel Wi-Fi are at risk of state-sponsored interception. The integration of AI-augmented phishing and the shift toward browser-based credential harvesting indicate that traditional endpoint protection may be bypassed if the user is socially engineered into executing administrative commands. The ability to pivot from a simple Wi-Fi connection to a full Microsoft 365 environment compromise via device code hijacking represents a critical threat to corporate data integrity.

Recommendations

Encrygma recommends the following mitigations:

1. Enforce always-on, full-tunnel VPN policies for all remote and traveling employees to ensure all traffic and DNS queries are routed through secure corporate resolvers.
2. Educate staff on the "ClickFix" social engineering technique; emphasize that legitimate security updates never require users to copy-paste commands into a terminal or shell.
3. Hardened endpoint policies should restrict the execution of PowerShell, CMD, and other administrative tools by non-privileged users.
4. Implement continuous monitoring for unauthorized DNS redirections and the presence of unusual scheduled tasks on mobile workstations, particularly those associated with browser maintenance or fake updates.