Russian hackers target hotel Wi-Fi to steal corporate data
Microsoft Threat Intelligence has recently exposed a global espionage operation carried out by Russian state-backed hackers. The network targets the public wireless networks of conference venues and hotels.
The operation, known as CaptiveCrunch, is attributed to a collective called Storm-2945. This group is regarded as a branch of Midnight Blizzard, an entity that intelligence services in the United Kingdom and the US have linked to the SVR, Russia’s foreign intelligence service.
To increase the efficiency of their attacks, the perpetrators are using artificial intelligence to set up sophisticated phishing schemes and distribute malware. The group gains control over the management systems of wifi portals in hotels, allowing them to redirect internet traffic.
Guests are then deceived by fake system alerts or fraudulent prompts for browser updates, which steer them to malicious servers.
According to findings from ReliaQuest, the primary goal is to collect login credentials and tokens from prominent corporate figures. This allows the hackers to penetrate secured Microsoft 365 enterprise environments.
This strategy enables the Russian operatives to bypass standard corporate security barriers by attacking executives while they are travelling and not connected to their head office’s security systems.
Midnight Blizzard is known for conducting intelligence missions that align with the Kremlin’s international objectives, frequently targeting European and American diplomatic institutions, government agencies, and IT companies. This current campaign is part of a broader pattern of aggression.
Earlier reports highlighted a year-long operation that made use of zero-click vulnerabilities in e-mail to infiltrate Nato contractors and nuclear scientists in the US.
In response to these threats, Microsoft advises companies to discourage the use of untrusted public Wi-Fi. Instead, they propose using company-managed travel routers or mobile hotspots and implementing strict identity verification to protect cloud assets.
Business AM
Subscribers 0
Fans 0
Followers 0
Followers