Storm-2945 Hijacks Global Hotel Wi-Fi in 'CaptiveCrunch' Espionage Campaign Targeting Travelers

Executive Summary

On August 4, 2026, threat intelligence reports from Microsoft MSTIC and Check Point Research detailed a widespread cyber espionage operation dubbed "CaptiveCrunch." Attributed to the Russian-linked threat actor Storm-2945 (also known as Midnight Blizzard or APT29), the campaign focuses on compromising hotel and conference center Wi-Fi networks to intercept the communications of high-profile travelers, including government officials, diplomats, and corporate executives. The operation leverages the inherent trust users place in hospitality infrastructure to deploy surveillance malware and steal cloud authentication tokens.

Threat Analysis

The attackers gain initial access by compromising the captive portals of hospitality providers and conference venues. When a guest attempts to connect to the Wi-Fi, they are presented with a legitimate-looking but malicious prompt—often disguised as a mandatory browser update or a security certificate installation required for internet access. This social engineering tactic exploits the situational vulnerability of travelers who require immediate connectivity. Once the user interacts with the prompt, the infection chain begins, bypassing traditional perimeter defenses by operating within the victim's trusted travel environment.

Technical Details

The primary payloads delivered in this campaign are "CornFlake," a remote access trojan (RAT), and "ChocoShell," a stealthy backdoor. CornFlake is particularly invasive, capable of capturing webcam images, microphone audio, and keystrokes to monitor the victim's physical and digital surroundings. However, the primary objective of CaptiveCrunch is the harvesting of Microsoft 365 and Azure Active Directory (Azure AD) authentication tokens. By stealing these session tokens, Storm-2945 can bypass Multi-Factor Authentication (MFA) through session hijacking. This enables the actors to gain persistent access to the victim's cloud environment, including Outlook mailboxes, Teams communications, and SharePoint repositories, even after the victim has disconnected from the compromised Wi-Fi.

Attribution Assessment

Microsoft MSTIC and Check Point attribute this activity to Storm-2945 with high confidence. The tactics, techniques, and procedures (TTPs)—specifically the focus on cloud token theft and the use of custom Go-based malware—align with previous operations conducted by the Russian Foreign Intelligence Service (SVR). The group's history of targeting diplomatic and government entities for long-term intelligence collection further supports this assessment. The infrastructure used for command-and-control (C2) also shows significant overlap with known Midnight Blizzard operations from early 2026.

Implications

This campaign represents a significant tactical evolution toward the "physical-digital" intersection of travel. By targeting the infrastructure of the hospitality sector, Storm-2945 circumvents traditional corporate security controls. The ability to maintain access to M365 environments after a traveler returns home poses a long-term intelligence risk, as the actors can silently exfiltrate sensitive data for months without further interaction with the victim's device.

Recommendations

Encrygma recommends that organizations mandate the use of Always-On VPNs for all traveling staff to encrypt traffic from the point of origin. Employees should be trained to recognize suspicious prompts on public Wi-Fi and instructed never to download "updates" or "certificates" from captive portals. Security teams should implement token-binding and conditional access policies that restrict session usage to known, managed devices and specific geographic locations to mitigate the impact of token theft.