Midnight Blizzard (APT29), a Russian state-sponsored threat actor, has been linked to a recent campaign targeting public Wi-Fi gateway appliances at hospitality and captive portal networks. The attackers manipulated DNS configurations on compromised SOHO routers to redirect users to attacker-controlled infrastructure, enabling adversary-in-the-middle interception of Microsoft 365 credentials. The campaign targeted multiple sectors including financial services, legal, healthcare, energy, and retail. Attackers delivered Golang-based Windows RATs and infostealers via fake browser updates and used social engineering to trick Android users into installing malicious APKs. The operation also incorporated device code phishing to hijack authentication flows, increasing the effectiveness of credential theft. Microsoft attributes this activity to the subgroup Storm-2945 of Midnight Blizzard, known for espionage aligned with Russian foreign intelligence interests.

The threat actor successfully intercepted Microsoft 365 credentials and session tokens of users on compromised public Wi-Fi networks, enabling unauthorized access to corporate accounts. The deployed malware facilitated extensive espionage capabilities including file and keystroke collection, audio and video surveillance, and remote shell access. This compromises the confidentiality and integrity of affected organizations' data and communications, particularly impacting sectors with sensitive information such as financial, legal, healthcare, and energy. The integration of device code phishing into captive portal attacks increases the risk of successful authentication compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations operating captive portal networks and hospitality Wi-Fi should monitor for unauthorized DNS configuration changes and suspicious traffic redirection. Users should be educated to recognize phishing attempts, especially device code phishing, and avoid installing unsolicited software updates or APKs from untrusted sources. Network administrators should consider enhancing network segmentation and access controls on captive portal infrastructure. Microsoft and other vendors may provide further guidance and detection tools; consult their advisories for updates.