Infosecurity
APT29 hijacks hotel Wi‑Fi to spy on travelers via fake updates
Part of the UNC2452 story · since 1 Sep 2025
Developinglatest 3 hours ago12 articles8 outlets
- Mon 1 Sep, 19:15 UTC. BleepingComputer, first report. Amazon disrupts Russian APT29 hackers targeting Microsoft 365.
- Fri 31 Jul, 21:50 UTC. Microsoft, its first report on the story. Midnight Blizzard Offshoot Hits Travellers With CaptiveCrunch.
- Mon 3 Aug, 14:51 UTC. Infosecurity, its first report on the story. APT29 hijacks hotel Wi‑Fi to spy on travelers via fake updates. This article, 3rd of 12.
- Fri 11 Sep, 08:59 UTC. SecurityWeek, its first report on the story. Russian Hackers Used Claude to Evade Detection in Spy Campaign.
- Wed 4 Nov, 14:30 UTC. Infosecurity. APT29 uses watering holes to target mobile devices with exploits. Cites a CVE in CISA KEV.
- Wed 4 Nov, 15:30 UTC. The Hacker News, its first report on the story. APT29 linked to mobile watering hole campaign using exploits. Cites a CVE in CISA KEV.
- Wed 4 Nov, 23:00 UTC. Ars Technica, its first report on the story. Sekoia links mobile exploit attacks to Russia's APT29.
- Thu 5 Nov, 07:00 UTC. The Hacker News. CISA Adds Exploited Apple Flaw to Its KEV Catalog. Cites a CVE in CISA KEV.
- Thu 5 Nov, 09:00 UTC. SecurityOnline, its first report on the story. APT29 watering hole campaign targets mobile users with exploits. Cites a CVE in CISA KEV.
- Thu 5 Nov, 09:30 UTC. Security Affairs, its first report on the story. CISA adds Apple flaw linked to APT29 to its exploited list. Cites a CVE in CISA KEV.
- Thu 5 Nov, 11:30 UTC. Security Affairs. Sekoia links APT29 to mobile watering hole attacks.
- Thu 5 Nov, 11:30 UTC. SecurityWeek. Midnight Blizzard targets mobile devices with exploit chains. Cites a CVE in CISA KEV.
A new cyber-espionage campaign named 'CaptiveCrunch', attributed to the Russian hacking group Midnight Blizzard (also known as APT29), targets travelers by hijacking captive portals on hotel and conference Wi-Fi networks. This attack serves fake updates that install Russian espionage malware, specifically a remote access trojan (RAT) named CornFlake. The campaign, ongoing since early May 2026, exploits connectivity checks to deploy malware, posing as legitimate software updates.
Microsoft's investigation revealed vulnerabilities in shared services within the captive portal ecosystem. Recommendations include treating public Wi-Fi as untrustworthy and avoiding installations from captive portals.
How the story developed
Developinglatest 3 hours ago12 articles8 outlets
12 articles from 8 outlets since 1 Sep. Picked up again on 4 Nov after 8 weeks quiet. This was the 3rd report, 336 days after the first.
- Mon 1 Sep, 19:15 UTC. BleepingComputer, first report. Amazon disrupts Russian APT29 hackers targeting Microsoft 365.
- Fri 31 Jul, 21:50 UTC. Microsoft, its first report on the story. Midnight Blizzard Offshoot Hits Travellers With CaptiveCrunch.
- Mon 3 Aug, 14:51 UTC. Infosecurity, its first report on the story. APT29 hijacks hotel Wi‑Fi to spy on travelers via fake updates. This article, 3rd of 12.
- Fri 11 Sep, 08:59 UTC. SecurityWeek, its first report on the story. Russian Hackers Used Claude to Evade Detection in Spy Campaign.
- Wed 4 Nov, 14:30 UTC. Infosecurity. APT29 uses watering holes to target mobile devices with exploits. Cites a CVE in CISA KEV.
- Wed 4 Nov, 15:30 UTC. The Hacker News, its first report on the story. APT29 linked to mobile watering hole campaign using exploits. Cites a CVE in CISA KEV.
- Wed 4 Nov, 23:00 UTC. Ars Technica, its first report on the story. Sekoia links mobile exploit attacks to Russia's APT29.
- Thu 5 Nov, 07:00 UTC. The Hacker News. CISA Adds Exploited Apple Flaw to Its KEV Catalog. Cites a CVE in CISA KEV.
- Thu 5 Nov, 09:00 UTC. SecurityOnline, its first report on the story. APT29 watering hole campaign targets mobile users with exploits. Cites a CVE in CISA KEV.
- Thu 5 Nov, 09:30 UTC. Security Affairs, its first report on the story. CISA adds Apple flaw linked to APT29 to its exploited list. Cites a CVE in CISA KEV.
- Thu 5 Nov, 11:30 UTC. Security Affairs. Sekoia links APT29 to mobile watering hole attacks.
- Thu 5 Nov, 11:30 UTC. SecurityWeek. Midnight Blizzard targets mobile devices with exploit chains. Cites a CVE in CISA KEV.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 12 articles as a listHide the list
- Mon 1 SepDay 01
- Amazon disrupts Russian APT29 hackers targeting Microsoft 36519:15 · BleepingComputer · First report
Quiet for 48 weeks
Fri 31 JulDay 3331- Midnight Blizzard Offshoot Hits Travellers With CaptiveCrunch21:50 · Microsoft · Picked up again
Quiet for 3 days
Mon 3 AugDay 3361- APT29 hijacks hotel Wi‑Fi to spy on travelers via fake updates14:51 · Infosecurity · Picked up again · This article, 3rd of 12
Quiet for 6 weeks
Fri 11 SepDay 3751- Russian Hackers Used Claude to Evade Detection in Spy Campaign08:59 · SecurityWeek · Picked up again
Quiet for 8 weeks
Wed 4 NovDay 4293- APT29 uses watering holes to target mobile devices with exploits14:30 · Infosecurity · Exploited CVE · Picked up again · Known exploited CVE
- APT29 linked to mobile watering hole campaign using exploits15:30 · The Hacker News · Known exploited CVE
- Sekoia links mobile exploit attacks to Russia's APT2923:00 · Ars Technica
- Thu 5 NovDay 4305
- APT29 watering hole campaign targets mobile users with exploits09:00 · SecurityOnline · Known exploited CVE
- CISA adds Apple flaw linked to APT29 to its exploited list09:30 · Security Affairs · Known exploited CVE
Show 2 more from 5 Nov
- Sekoia links APT29 to mobile watering hole attacks11:30 · Security Affairs
- Midnight Blizzard targets mobile devices with exploit chains11:30 · SecurityWeek · Known exploited CVE