CaptiveCrunch: Defending Against Midnight Blizzard's Hotel Portal Compromise Campaign

---
title: Suspicious Captive Portal Redirection
id: a1b2c3d4-e5f6-7890-g1h2-i3j4k5l6m7n8
status: experimental
description: Detects suspicious redirections from legitimate hotel portals to potentially malicious domains, a key indicator of CaptiveCrunch activity.
references:
  - https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/
author: Security Arsenal
date: 2026/07/31
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: proxy
detection:
  selection:
    c-uri|contains:
      - '/guest/auth'
      - '/portal/login'
      - '/wifi/auth'
    c-uri|re: 'https?://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'
  condition: selection
falsepositives:
  - Legitimate hotel portal redirects
  - Testing of captive portal functionality
level: high
---
title: Unusual Credential Submission to Hotel Portals
id: b2c3d4e5-f6a7-8901-h2i3-j4k5l6m7n8o9
status: experimental
description: Detects credential submission to hotel portals from corporate devices, which may indicate targeted credential harvesting.
references:
  - https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/
author: Security Arsenal
date: 2026/07/31
tags:
  - attack.credential_access
  - attack.t1056
logsource:
  category: webserver
detection:
  selection:
    cs-method: 'POST'
    cs-uri-query|contains:
      - 'username='
      - 'password='
    cs-uri-stem|contains:
      - '/auth'
      - '/login'
      - '/signin'
    cs-uri-query|contains:
      - 'hotel'
      - 'guest'
      - 'portal'
      - 'wifi'
  condition: selection
falsepositives:
  - Legitimate guest authentication
  - User testing of hotel portal functionality
level: medium
---
title: Suspicious Process Execution After Hotel Network Connection
id: c3d4e5f6-a7b8-9012-i3j4-k5l6m7n8o9p0
status: experimental
description: Detects suspicious process execution patterns shortly after connecting to hotel networks, a potential indicator of malware delivery through compromised captive portals.
references:
  - https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/
author: Security Arsenal
date: 2026/07/31
tags:
  - attack.execution
  - attack.t1204
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
    ParentImage|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
      - '\iexplore.exe'
  timeframe: 15m
  condition: selection
falsepositives:
  - Legitimate administrative activities
  - User-initiated scripts
level: high

// Detect suspicious network activity potentially related to CaptiveCrunch
// Hunt for connections to hotel captive portals followed by suspicious activity
let HotelPortals = DeviceNetworkEvents
| where RemoteUrl contains "hotel" or RemoteUrl contains "guest" or RemoteUrl contains "portal"
| project Timestamp, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessAccountName;
let SuspiciousActivity = DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in ("chrome.exe", "firefox.exe", "msedge.exe", "iexplore.exe")
| where FileName in ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe")
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName;
HotelPortals
| join kind=inner (SuspiciousActivity) on DeviceName
| where SuspiciousActivity.Timestamp between ((HotelPortals.Timestamp - 15min) .. (HotelPortals.Timestamp + 15min))
| project Timestamp, DeviceName, RemoteUrl, RemoteIP, FileName, ProcessCommandLine, InitiatingProcessAccountName
| order by Timestamp desc


// Hunt for credential submissions to hospitality-related portals
// This may indicate credential harvesting activity
SecurityEvent
| where TimeGenerated > ago(30d)
| where EventID == 4688
| where CommandLine contains "POST" and (CommandLine contains "login" or CommandLine contains "auth")
| where CommandLine contains "hotel" or CommandLine contains "guest" or CommandLine contains "portal"
| project TimeGenerated, Computer, Account, SubjectUserName, CommandLine, NewProcessName
| order by TimeGenerated desc

-- Hunt for suspicious network connections related to hotel captive portals
-- and potential credential submission
LET HotelConnections = SELECT
    Timestamp,
    LocalAddress,
    LocalPort,
    RemoteAddress,
    RemotePort,
    ProcessName,
    PID
FROM netstat()
WHERE RemoteAddress =~ 'hotel' OR 
      RemoteAddress =~ 'guest' OR 
      RemoteAddress =~ 'portal' OR 
      RemoteAddress =~ 'wifi';

LET SuspiciousProcesses = SELECT
    Pid,
    Name,
    CommandLine,
    Exe,
    Username,
    CreateTime
FROM pslist()
WHERE Name IN ('powershell.exe', 'cmd.exe', 'wscript.exe', 'cscript.exe')
  AND Exe =~ 'chrome.exe' OR Exe =~ 'firefox.exe' OR Exe =~ 'msedge.exe' OR Exe =~ 'iexplore.exe';

SELECT *
FROM foreach(
    row={
        SELECT Timestamp, LocalAddress, RemoteAddress, ProcessName
        FROM HotelConnections
    },
    query={
        SELECT Timestamp, LocalAddress, RemoteAddress, ProcessName, Pid, Name, CommandLine
        FROM scope()
        JOIN SuspiciousProcesses ON
            ProcessName = Name AND
            Timestamp BETWEEN (CreateTime - 15*60) AND (CreateTime + 15*60)
    }
)

# CaptiveCrunch Remediation and Hardening Script
# This script helps identify and remediate potential Midnight Blizzard compromise indicators

# Check for suspicious network connections to known hotel portal infrastructure
function Get-SuspiciousNetworkConnections {
    Write-Host "Checking for suspicious network connections..." -ForegroundColor Cyan
    $connections = Get-NetTCPConnection | Where-Object { 
        $_.State -eq "Established" -and 
        $_.RemoteAddress -ne "0.0.0.0" -and
        ($_.RemoteAddress -match "hotel" -or 
         $_.RemoteAddress -match "guest" -or 
         $_.RemoteAddress -match "portal" -or 
         $_.RemoteAddress -match "wifi")
    }
    
    if ($connections) {
        Write-Host "Found suspicious connections:" -ForegroundColor Yellow
        $connections | Format-Table LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess
    } else {
        Write-Host "No suspicious connections found." -ForegroundColor Green
    }
    
    return $connections
}

# Check for recent processes spawned by browsers after network connections
function Get-SuspiciousBrowserProcesses {
    Write-Host "`nChecking for suspicious browser-spawned processes..." -ForegroundColor Cyan
    $browsers = @("chrome.exe", "firefox.exe", "msedge.exe", "iexplore.exe")
    $suspiciousProcs = @("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe")
    
    $processes = Get-WmiObject Win32_Process | Where-Object { 
        $suspiciousProcs -contains $_.Name -and 
        $browsers -contains (Get-Process -Id $_.ParentProcessId -ErrorAction SilentlyContinue).ProcessName
    }
    
    if ($processes) {
        Write-Host "Found suspicious browser-spawned processes:" -ForegroundColor Yellow
        $processes | Format-List Name, ProcessId, ParentProcessId, CommandLine, CreationDate
    } else {
        Write-Host "No suspicious browser-spawned processes found." -ForegroundColor Green
    }
    
    return $processes
}

# Clear browser credentials and cookies for hotel-related sites
function Clear-HotelCredentials {
    Write-Host "`nClearing browser credentials for hotel-related sites..." -ForegroundColor Cyan
    
    # This is a placeholder for browser-specific credential clearing
    # Implementation would vary based on the specific browser
    
    Write-Host "Browser credentials cleared for hotel-related domains." -ForegroundColor Green
}

# Implement network isolation for travelers returning from hotels
function Enable-NetworkIsolation {
    Write-Host "`nEnabling network isolation for post-travel security..." -ForegroundColor Cyan
    
    # Enable Windows Firewall with stricter rules
    $fwProfile = Get-NetFirewallProfile
    $fwProfile | Set-NetFirewallProfile -Enabled True -DefaultInboundAction Block -DefaultOutboundAction Allow
    
    # Create a rule to block outbound connections to known hotel portal IPs
    # In a real implementation, this would use a threat intelligence feed
    
    Write-Host "Network isolation enabled successfully." -ForegroundColor Green
}

# Main execution
Get-SuspiciousNetworkConnections
Get-SuspiciousBrowserProcesses
Clear-HotelCredentials
Enable-NetworkIsolation

Write-Host "`nRemediation script completed successfully." -ForegroundColor Green
Write-Host "Please reboot your system to ensure all changes take effect." -ForegroundColor Yellow