MicrosoftPublished
CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft
By Microsoft Threat Intelligence
Excerpt
Since early May 2026, Microsoft Threat Intelligence has observed Storm-2945, a sub-cluster of Midnight Blizzard, conducting widespread but targeted traffic manipulation attacks involving hospitality sector networks served by captive portals worldwide. Despite some tactic, technique, and procedure (TTP) similarities to the Forest Blizzard DNS hijacking operation that we publicly disclosed in April 2026, we attribute this campaign, whic…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Microsoft on microsoft.com.
Mentioned in the excerpt
More from Microsoft30
- dd252791.aspxMicrosoft · Added 19 Oct
- ms14-068.aspxMicrosoft · Added 19 Oct
- assocMicrosoft · Added 18 Oct
- The Gentlemen ransomware: Dissecting a self-propagating Go encryptorMicrosoft · Published 28 May
On the same topics
- Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRatMalwarebytes · Published 5 Jan 2021
- Kazuar (Malware Family)Malpedia · Added 18 Oct
- Animal Farm APT and the Shadow of French IntelligenceInfosec Institute · Published 8 Jul 2015
- Darktrace Malware Analysis: Unpacking SnappyBeeDarktrace · Published 3 Feb
