Adversary Intelligence — 2026-10-19

SentinelOne Exposes APT29 CaptiveCrunch Campaign Where SVR Cyber Operators Used Hotel Wi-Fi Captive Portals to Deploy CornFlake RAT Against Targets in Three Regions

BLUFDisabling LLMNR on roaming endpoints and auditing the 49 unresolved token requests are immediate priorities, because it is unlikely that a US or allied government agency publishes an advisory naming CaptiveCrunch by November 30, 2026.

Microsoft attributed the CaptiveCrunch campaign to Storm-2945, a Midnight Blizzard (APT29) subgroup tied to Russia's SVR, which SecurityWeek reported began manipulating DNS and HTTP traffic on captive portal networks in May 1. Microsoft said the actors served Golang RATs disguised as browser updates, including CornFlake and the ChocoShell infostealer 1. SentinelOne reported seeing the operation across multiple protected environments in three regions, and said its agent convicted every delivered payload before execution 2. SentinelOne also reported LLMNR poisoning on roughly a third of affected hosts, and 49 token requests sent to a poisoned Microsoft login domain, with outcomes unconfirmed 2.

Analysis
Confidence is moderate, because the assessment rests on two vendor accounts with no government statement: attribution is Microsoft's, relayed through one trade outlet, and the technical detail comes from a single vendor with an interest in showing its product worked. The campaign now extends beyond the July captive-portal credential harvest to LLMNR poisoning inside victim network segments in three regions. Poisoning with no payload on about half of affected hosts suggests credential and token theft was a primary objective. A US or allied government agency is unlikely to publish an advisory or joint statement naming CaptiveCrunch, Storm-2945, or the CornFlake RAT by November 30, 2026. Government silence may instead reflect a quiet advisory process, since the six-week window is short. Absent an advisory, organizations with traveling staff must act on vendor reporting alone: disable LLMNR on roaming laptops and review sign-ins and token issuance for the 49 token requests sent to the poisoned Microsoft login domain, whose outcomes no one has confirmed.

2 sources