[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$foUg4FjTxVzmes6-Ce5PKoumj4L7y0f97RFd6LUvjhw0":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":26,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":53,"controls":60},"e840d586-3ad2-476d-80b0-67bbfc5b1c46","apt29-exploits-hotel-wi-fi-to-steal-microsoft-365-credentials","0810a762-8a71-4542-aa58-c1e0587c49ab","APT29 Exploits Hotel Wi-Fi to Steal Microsoft 365 Credentials","The CaptiveCrunch campaign demonstrates how nation-state actors abuse trusted but insecure public Wi-Fi infrastructure to intercept credentials through DNS manipulation and convincing phishing pages. By compromising hotel networks — environments users implicitly trust — Midnight Blizzard bypassed perimeter defenses and targeted credentials at the point of entry. The deployment of custom malware (CornFlake RAT and ChocoShell) alongside a management panel signals a mature, persistent operation rather than an opportunistic attack. This matters because Microsoft 365 credentials provide broad access to organizational data, email, and cloud resources, making them high-value targets with cascading breach potential.","**Immediate actions:**\n- Enforce phishing-resistant MFA (FIDO2\u002Fhardware keys) on all Microsoft 365 accounts to render stolen passwords alone insufficient.\n- Deploy Conditional Access policies that block or challenge authentications from untrusted or unfamiliar network locations.\n- Remind staff never to access corporate resources over public or hotel Wi-Fi without an approved corporate VPN.\n\n**Long-term improvements:**\n- Implement a Zero Trust Network Access (ZTNA) model so that network location is never treated as implicit trust.\n- Adopt DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) on managed endpoints to prevent DNS hijacking on untrusted networks.\n- Maintain a device compliance posture requiring endpoint health checks before granting access to cloud resources.\n\n**Detection measures:**\n- Enable Microsoft Entra ID (Azure AD) sign-in risk policies and Identity Protection to flag anomalous authentication patterns and impossible travel events.\n- Monitor for PowerShell execution anomalies and unauthorized RAT-like network beaconing using endpoint detection and response (EDR) tooling.\n- Correlate DNS query logs with threat intelligence feeds to identify connections to known APT29 infrastructure.",[12,13,14,15,16,17,18,19,20,21,22,23,24,25],"CIS Control 4 – Secure Configuration of Enterprise Assets","CIS Control 6 – Access Control Management","CIS Control 9 – Email and Web Browser Protections","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-63B – Digital Identity Guidelines (Phishing-Resistant MFA)","NIST AC-17 – Remote Access","NIST AC-2 – Account Management","NIST SI-3 – Malicious Code Protection","NIST SC-20\u002FSC-21 – Secure DNS","NIST SP 800-207 – Zero Trust Architecture","MITRE ATT&CK T1557 – Adversary-in-the-Middle","MITRE ATT&CK T1071 – Application Layer Protocol (C2)","MITRE ATT&CK T1078 – Valid Accounts","GDPR Article 32 – Security of Processing (for EU-operating hotels and businesses)",{},"published","2026-08-04T02:20:43.314943+00:00","2026-08-04T02:20:43.002+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhotel-wi-fi-attacks-use-custom-malware-to-breach-microsoft-365-accounts\u002F","hotel-wi-fi-attacks-use-custom-malware-to-breach-microsoft-365-accounts-d3d8e6","Hotel Wi-Fi attacks use custom malware to breach Microsoft 365 accounts",[35,41,47],{"id":36,"name":37,"slug":38,"description":39,"color":40},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":42,"name":43,"slug":44,"description":45,"color":46},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":48,"name":49,"slug":50,"description":51,"color":52},"f43a7f30-5046-4b10-9dba-1a704139821e","Network Segmentation","network-segmentation","Lateral movement, flat networks, missing firewalls","#06b6d4",[54],{"id":55,"date":56,"edition":57,"title":58,"audio_url":59},"366b9095-a756-4506-865f-b4e0b20d8676","2026-08-04","morning","ThreatNoir Morning Brief — August 4","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-08-04\u002Fthreatnoir-morning-brief-2026-08-04.mp3",[61,65,69],{"slug":62,"name":63,"problem":64},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":66,"name":67,"problem":68},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":70,"name":71,"problem":72},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home."]