Midnight Blizzard CaptiveCrunch + LegionLoader ClickFix + Melofee Linux Implant: OTX Pulse Analysis — Enterprise Detection Pack

Threat Summary

Three concurrent OTX pulses published 2026-09-11 reveal a threat landscape dominated by identity compromise and modular implant evolution:

1. CaptiveCrunch (Midnight Blizzard / UNC2452 / APT29 / Cozy Bear) — Russia's SVR-linked espionage group is weaponizing hotel and conference-center Wi-Fi captive portals. By manipulating DNS and HTTP responses on captive portal networks, operators redirect victims to attacker-controlled infrastructure serving Microsoft 365 phishing pages, device code phishing flows abusing Microsoft Entra ID, and ClickFix-style social engineering delivering the CornFlake and ChocoShell payloads. Targeting spans the United States, India, Saudi Arabia, and the British Indian Ocean Territory — consistent with diplomatic, government, and corporate traveler targeting. CVE-2026-21509 is associated with the campaign's exploitation chain.

2. LegionLoader via ClickFix — A crimeware loader distributed through fake Cloudflare CAPTCHA pages and spear phishing. One vector poisons Korea's "Newlywed Hope Town" Namu Wiki page with malicious URLs; the other impersonates internal IT account-issuance instructions to specific companies. Victims are coerced into pasting and executing malicious commands — the hallmark ClickFix technique — which stages LegionLoader for downstream payload delivery.

3. Melofee Linux implant (APT41 ecosystem) — Three years post-discovery, Melofee has evolved into a modular implant with hot-loadable components for shell access, file management, and command execution. New variants support runtime C2 reconfiguration and hide via a Reptile-based kernel rootkit. The pulse links Melofee to the broader Chinese-nexus tooling ecosystem: ShadowPad, PlugX/Korplug, Spark, Cobalt Strike, StowAway, CrowDoor, TernDoor, Hemigate, and RatelS.

Collective objective: covert, persistent access — APT29 harvesting cloud identities from traveling executives, LegionLoader monetizing initial access, and APT41 maintaining deep Linux footholds. All three campaigns converge on the same enterprise weak points: user-assisted execution, identity trust, and unmanaged Linux infrastructure.

Threat Actor / Malware Profile

Midnight Blizzard (UNC2452 / APT29) — CaptiveCrunch

• Distribution: DNS/HTTP manipulation on compromised captive portal networks (hotels, conference venues). Victims connecting to Wi-Fi are transparently redirected.
• Payload behavior: M365 credential harvesting pages on look-alike domains (m365-owa.com, ms365-device.com, ms365-live.com, owa-ms365.com); device code phishing abusing the Entra ID OAuth device authorization grant; ClickFix delivery of CornFlake and ChocoShell.
• C2 communication: HTTPS to hardcoded IP infrastructure (e.g., 213.145.86.112) serving JavaScript staged under CDN-style paths (/cdn/chunks/polyfill-7e2b.min.js) to blend with legitimate traffic.
• Persistence: Stolen session tokens and refresh tokens via device code grants provide durable cloud access without endpoint persistence.
• Anti-analysis: Legitimate-domain mimicry, TLS on phishing infrastructure, token-based access that bypasses MFA prompts.

LegionLoader

• Distribution: Fake Cloudflare CAPTCHA ClickFix pages; poisoned wiki content; spear phishing themed as internal account provisioning (notably Korean targets).
• Payload behavior: User pastes an obfuscated command (typically PowerShell or mshta) that retrieves and executes the loader; LegionLoader then fetches secondary payloads (stealers, RATs).
• C2 communication: HTTPS to disposable domains (dallasbackstage.com, gemscocl.com).
• Persistence: Run keys and scheduled tasks established by staged payloads.
• Anti-analysis: CAPTCHA gating defeats sandboxes; payloads only delivered after human interaction.

Melofee (APT41)

• Distribution: Server-side compromise of Linux infrastructure; linked to ShadowPad/PlugX intrusion chains.
• Payload behavior: Modular implant — hot-loadable shell, file manager, and command execution plugins; runtime C2 reconfiguration.
• C2 communication: Infrastructure including 92.38.169.152, 185.163.2.79, 45.67.230.185, 180.149.44.115; decoy hostnames such as www.windefender.net and blog-en.itochuci.co.jp mimic security products and legitimate blogs.
• Persistence/stealth: Reptile-based kernel rootkit hides processes, files, and network connections from standard userland tooling.
• Anti-analysis: Kernel-level concealment defeats ps, netstat, and file listing; modular design limits forensic footprint.

IOC Analysis

The pulse indicator sets span five operationalizable types:

• Domains/hostnames (phishing & C2): m365-owa.com, ms365-device.com, ms365-live.com, owa-ms365.com (APT29 phishing); dallasbackstage.com, gemscocl.com (LegionLoader); windefender.net, blog.exatrack.com, blog-en.itochuci.co.jp (Melofee). Push to DNS sinkholes, web proxies, and TLS SNI inspection.
• IPv4 (C2): 213.145.86.112, 92.38.169.152, 185.163.2.79, 45.67.230.185, 180.149.44.115. Block at egress firewall; retro-hunt NetFlow and proxy logs for 90 days.
• URLs: http://213.145.86.112/cdn/chunks/polyfill-7e2b.min.js — hunt proxy logs for JS retrieved from raw-IP hosts, a high-fidelity anomaly.
• File hashes (SHA256/MD5): Add CornFlake/ChocoShell SHA256s and the five LegionLoader MD5s to EDR blocklists and threat intel platforms (MISP, Sentinel TAXII).
• CVE: CVE-2026-21509 — prioritize patching per the CaptiveCrunch exploitation chain.

SOC teams should ingest all indicators into a TIP with confidence scoring, and pair IOC matching with the behavioral detections below — APT29 and APT41 rotate infrastructure faster than blocklists update.

Detection Engineering

---
title: ClickFix User-Assisted Command Execution (LegionLoader / CaptiveCrunch)
id: 3f1a2b7c-9d4e-4a11-b8c2-capcru001fix
status: experimental
description: Detects ClickFix-style execution where PowerShell, mshta, or rundll32 is launched by a browser or explorer with clipboard-pasted obfuscated commands, consistent with LegionLoader fake CAPTCHA and Midnight Blizzard CaptiveCrunch delivery.
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\msedge.exe'
      - '\chrome.exe'
      - '\firefox.exe'
      - '\explorer.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\wscript.exe'
  selection_flags:
    CommandLine|contains:
      - '-enc'
      - '-e '
      - 'FromBase64String'
      - 'IEX'
      - 'Invoke-Expression'
      - 'curl '
      - 'http'
  condition: selection_parent and selection_child and selection_flags
level: high
tags:
  - attack.execution
  - attack.t1059
  - attack.t1204
  - attack.t1189
date: 2026/09/11
---
title: Midnight Blizzard CaptiveCrunch Phishing and C2 Domain Resolution
id: 7c2d8e1a-4b5f-4c9d-a3e7-capcru002dns
status: experimental
description: Detects DNS resolution or network connections to known CaptiveCrunch M365 phishing domains and staging infrastructure used by Midnight Blizzard (UNC2452/APT29).
author: Security Arsenal
logsource:
  category: dns
  product: windows
detection:
  selection:
    query|contains:
      - 'm365-owa.com'
      - 'ms365-device.com'
      - 'ms365-live.com'
      - 'owa-ms365.com'
      - 'dallasbackstage.com'
      - 'gemscocl.com'
      - 'windefender.net'
  condition: selection
level: critical
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.t1566
date: 2026/09/11
---
title: Melofee Linux Implant Rootkit and C2 Activity
id: 9e4b6c2d-1f8a-4d7b-b5c3-melofee003lx
status: experimental
description: Detects Melofee behaviors on Linux including Reptile kernel module loading, suspicious outbound connections to known C2 addresses, and hidden process artifacts consistent with APT41 Linux implants.
author: Security Arsenal
logsource:
  category: process_creation
  product: linux
detection:
  selection_module:
    CommandLine|contains:
      - 'insmod'
      - 'modprobe reptile'
      - 'reptile'
      - 'diamorphine'
  selection_c2:
    CommandLine|contains:
      - '92.38.169.152'
      - '185.163.2.79'
      - '45.67.230.185'
      - '180.149.44.115'
  selection_shell:
    Image|endswith:
      - '/bash'
      - '/sh'
    CommandLine|contains:
      - '/dev/tcp/'
      - 'nc -e'
      - 'ncat -e'
  condition: 1 of selection_*
level: high
tags:
  - attack.defense_evasion
  - attack.t1014
  - attack.command_and_control
  - attack.t1059.004
date: 2026/09/11

// Hunt: CaptiveCrunch phishing, LegionLoader C2, Melofee infrastructure, and ClickFix execution
let PhishDomains = dynamic(["m365-owa.com","ms365-device.com","ms365-live.com","owa-ms365.com"]);
let LoaderDomains = dynamic(["dallasbackstage.com","gemscocl.com"]);
let MelofeeIoCs = dynamic(["92.38.169.152","185.163.2.79","45.67.230.185","180.149.44.115","windefender.net","blog.exatrack.com","blog-en.itochuci.co.jp"]);
let CaptiveC2 = dynamic(["213.145.86.112"]);
let NetHits =
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl has_any (PhishDomains) or RemoteUrl has_any (LoaderDomains)
      or RemoteUrl has_any (MelofeeIoCs)
      or RemoteIP in (CaptiveC2)
      or RemoteIP in (dynamic(["92.38.169.152","185.163.2.79","45.67.230.185","180.149.44.115"]))
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType;
let ClickFix =
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("msedge.exe","chrome.exe","firefox.exe","explorer.exe")
| where FileName in~ ("powershell.exe","pwsh.exe","mshta.exe","rundll32.exe","wscript.exe")
| where ProcessCommandLine has_any ("-enc","FromBase64String","IEX","Invoke-Expression","curl ")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine;
union NetHits, ClickFix
| sort by TimeGenerated desc

# Security Arsenal — CaptiveCrunch / LegionLoader IOC Hunt Script
# Run elevated on Windows endpoints. Checks network, persistence, and file artifacts.

$ErrorActionPreference = 'SilentlyContinue'
$badDomains = @('m365-owa.com','ms365-device.com','ms365-live.com','owa-ms365.com',
                'dallasbackstage.com','gemscocl.com','windefender.net',
                'blog.exatrack.com','blog-en.itochuci.co.jp')
$badIPs = @('213.145.86.112','92.38.169.152','185.163.2.79','45.67.230.185','180.149.44.115')
$badHashes = @('918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593',
               'be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c')

Write-Host "=== [1] Active connections to known C2 / phishing IPs ==="
Get-NetTCPConnection | Where-Object { $badIPs -contains $_.RemoteAddress } |
  Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess |
  Format-Table -AutoSize

Write-Host "=== [2] DNS cache matches for malicious domains ==="
$dns = Get-DnsClientCache
foreach ($d in $badDomains) {
  $dns | Where-Object { $_.Entry -like "*$d*" } |
    Select-Object Entry, Data, Status | Format-Table -AutoSize
}

Write-Host "=== [3] Run-key persistence referencing suspicious paths/scripts ==="
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce',
             'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce')
foreach ($k in $runKeys) {
  Get-ItemProperty -Path $k | ForEach-Object {
    $_.PSObject.Properties | Where-Object {
      $_.Value -match 'powershell|mshta|rundll32|wscript|AppData|Temp|http'
    } | Select-Object @{n='Key';e={$k}}, Name, Value
  }
} | Format-Table -AutoSize -Wrap

Write-Host "=== [4] Scheduled tasks with suspicious actions ==="
Get-ScheduledTask | ForEach-Object {
  $actions = ($_.Actions | Out-String)
  if ($actions -match 'powershell|mshta|rundll32|http|AppData') {
    [PSCustomObject]@{ TaskName=$_.TaskName; State=$_.State; Actions=$actions.Trim() }
  }
} | Format-Table -AutoSize -Wrap

Write-Host "=== [5] Hash sweep of common staging dirs for CornFlake / ChocoShell ==="
$staging = @("$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA\Temp","$env:PUBLIC\Downloads")
foreach ($dir in $staging) {
  Get-ChildItem -Path $dir -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
    $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
    if ($badHashes -contains $h) {
      Write-Host "[HIT] $($_.FullName)  SHA256=$h" -ForegroundColor Red
    }
  }
}

Write-Host "=== Hunt complete. Escalate any HIT to IR immediately. ==="

Response Priorities

Immediate (0–4 hours)

• Block all listed domains and IPs at DNS, proxy, and egress firewall; sinkhole the M365 look-alike domains.
• Push CornFlake/ChocoShell SHA256 and LegionLoader MD5 hashes to EDR blocklists.
• Run the KQL hunt across the last 14 days; isolate any host with confirmed connections to 213.145.86.112 or the Melofee C2 set.
• Alert travelers: prohibit corporate credential entry on hotel/conference captive portal sessions; mandate cellular hotspot or VPN-before-any-auth.

24 hours

• Credential theft is central to CaptiveCrunch: audit Entra ID sign-in logs for device code flow grants, anomalous token issuance, and impossible-travel logins from any user who recently traveled.
• Revoke refresh tokens and force re-authentication with phishing-resistant MFA (FIDO2/passkeys) for at-risk accounts.
• Sweep for ClickFix execution artifacts (browser-spawned PowerShell/mshta) across the fleet.
• On Linux servers, check for Reptile rootkit indicators: /dev/tcp reverse shells, unexpected kernel modules (lsmod | grep -i reptile), and discrepancies between netstat and packet captures.

1 week

• Patch CVE-2026-21509 across affected assets per the CaptiveCrunch exploitation chain.
• Enforce device code flow restrictions in Entra ID (Conditional Access blocking the device authorization grant where not required).
• Deploy always-on VPN with captive-portal detection that blocks traffic until the tunnel is established.
• Harden Linux servers: kernel module signing enforcement, EDR coverage on Linux workloads, egress filtering on server VLANs.
• Add ClickFix awareness to phishing training — users must never paste commands from web pages or emails into Run/Terminal dialogs.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub