OBSERVABILITY Signal 423
Russia-Linked 'Midnight Blizzard' Group Hijacks Hotel Wi-Fi With CaptiveCrunch
↗
A Russia-linked group called Midnight Blizzard has hijacked hotel and conference Wi-Fi portals worldwide, using fake captive-portal pages to steal credentials and session tokens.
The attack shows how trusted network infrastructure can be turned into a credential-harvesting vector for travelers, affecting multiple industries. Engineers must consider the security of captive-portal gateways and the need to validate software updates delivered over such networks. Detecting malicious redirects and blocking unauthorized software distribution becomes a priority for observability and incident response.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Midnight Blizzard (also tracked as NOBELIUM) is linked to Russia's SVR and uses the campaign name CaptiveCrunch.
Attackers compromise captive-portal gateways, redirecting users to phishing pages and fake updates that deploy tools like CornFlake and ChocoShell.
Observed victims span financial, professional, legal, health care, energy and retail sectors, indicating a broad focus on traveling employees rather than a single industry.
THE READ
What elseif makes of it.
Midnight Blizzard has taken control of hotel and conference Wi-Fi captive-portal gateways in several countries, though Microsoft did not name the specific venues or give a total count. By altering the portal’s login page, the group redirects guests to fraudulent sites that mimic legitimate software update prompts. Those fake pages are used to harvest usernames, passwords, session tokens and other sensitive data from anyone who connects. The ReliaQuest investigation confirmed similar compromises in hotels across the United States, India and Saudi Arabia.
Once a foothold is established, the attackers drop two primary tools onto the victim’s system. CornFlake is a Windows remote access trojan written in Go that can log keystrokes, capture screenshots, take webcam images, record audio and steal credentials and session tokens. ChocoShell is an in-memory PowerShell infostealer that focuses on browser cookies, saved passwords, Microsoft 365 single sign-on tokens and Wi-Fi credentials. Microsoft also noted indications that the group may be pushing Android users to download and install a malicious APK file with similar data-theft goals.
The traffic observed by ReliaQuest came from organizations in financial services, professional services, legal, health care, energy and retail, showing no concentration in a single sector. Microsoft’s analysis states the campaign targets traveling employees generally rather than a particular industry. This broad focus means any employee who relies on hotel or conference Wi-Fi for work is a potential victim. The lack of sector specificity complicates defensive prioritization based on asset criticality.
For engineers responsible for network observability, the event highlights the need to monitor captive-portal traffic for unexpected redirects or unsigned software downloads. Detecting the deployment of CornFlake or ChocoShell requires endpoint telemetry that can flag anomalous Go-based binaries or in-memory PowerShell activity. Alerts on unusual Android APK installation prompts from Wi-Fi portals can also aid early detection. Mitigation therefore involves tightening portal authentication, validating update signatures, and correlating network-level anomalies with endpoint behavior.
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER