Midnight Blizzard Hotel Wi-Fi Attacks: Defending Microsoft 365 Accounts Against Custom Malware

Microsoft has confirmed a sophisticated campaign orchestrated by the Russian state-sponsored threat actor Midnight Blizzard (APT29) targeting the hospitality sector. By compromising hotel Wi-Fi networks and deploying custom malware, the actors are intercepting network traffic to breach Microsoft 365 (M365) accounts of high-value travelers.

This is not a passive credential-harvesting operation; it involves active manipulation of network infrastructure to facilitate session theft. For security practitioners, the reality is stark: traditional perimeter defenses are bypassed when your users connect to hostile networks. We need to pivot to Zero Trust assumptions and robust monitoring of identity anomalies immediately.

Technical Analysis

Affected Products & Platforms:

Target: Microsoft 365 (Business and Enterprise accounts)
Vector: Hospitality Wi-Fi networks (Public Access Gateways)
Actor Infrastructure: Custom malicious software deployed on network gateways.

Vulnerability & Mechanism: While there is no specific CVE for the attack technique itself (as it relies on network manipulation rather than a software bug in M365), the attack chain involves the following TTPs:

Network Compromise: Midnight Blizzard gains access to the hotel's network infrastructure (routers/access points).
Malware Deployment: Custom malware is installed to facilitate traffic interception, likely DNS spoofing or TLS proxying.
Session Hijacking: The actors capture authentication tokens or credentials as users authenticate to M365 over the compromised network, bypassing MFA if session cookies are stolen.

Exploitation Status:

Status: Confirmed Active Exploitation (Global Campaign)
CISA KEV: Not applicable (Technique-based attack)

Detection & Response

Given the network-based nature of this threat, detection on the endpoint relies on identifying suspicious proxy configurations (a common side effect of network redirection attacks) and, more critically, identifying the successful authentication events from the victim's environment. The following queries focus on the victim endpoint behavior and the resulting M365 identity alerts.

SIGMA Rules

YAML

---
title: Suspicious System Proxy Configuration via Registry
id: 8d2e1a4b-9f3c-4a2d-8e1f-2b3c4d5e6f7a
status: experimental
description: Detects modification of the system proxy settings in the registry, often used by malware or malicious network configurations to redirect traffic. Midnight Blizzard hotel campaigns utilize traffic redirection.
references:
  - https://attack.mitre.org/techniques/T1090/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.t1090.001
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer'
      - 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable'
  condition: selection
falsepositives:
  - Legitimate IT administration changing proxy settings
  - VPN client installation
level: medium
---
title: Netsh Command to Configure WinHTTP Proxy
id: 9f3e2b5c-0a4d-4b3e-9f2a-3c4d5e6f7a8b
status: experimental
description: Detects usage of netsh to set a winhttp proxy. Threat actors often use this to force traffic through a malicious proxy for C2 or exfiltration.
references:
  - https://attack.mitre.org/techniques/T1090/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1090.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\netsh.exe'
    CommandLine|contains:
      - 'set proxy'
  condition: selection
falsepositives:
  - System administration
level: high

KQL (Microsoft Sentinel)

This query targets M365 sign-in logs indicative of "Impossible Travel" or anomalies often associated with session theft from foreign network infrastructure.

KQL — Microsoft Sentinel / Defender

// Hunt for M365 Sign-ins associated with Midnight Blizzard Hotel Wi-Fi Attacks
// Focus on successful logins from risky locations or impossible travel scenarios
SigninLogs
| where Result == "success"
| where ConditionalAccessStatus == "success" or ConditionalAccessStatus == "failure"
| project TimeGenerated, UserPrincipalName, AppDisplayName, ClientAppUsed, DeviceDetail, Location, IPAddress, RiskDetails
| extend LocationDetail = tostring(Location)
| mv-expand todynamic(LocationDetail)
| evaluate geo_arithmetic_operations(IPAddress)
| where Velocity > 500 km/h // Detect impossible travel
| summarize count() by bin(TimeGenerated, 1h), UserPrincipalName, IPAddress, City, Country
| order by count_ desc

Velociraptor VQL

This artifact hunts for modifications to the Windows Hosts file or suspicious network configurations on the endpoint, which can be indicators of DNS redirection associated with this attack.

VQL — Velociraptor

-- Hunt for modifications to the Hosts file and recent network changes
SELECT 
  FullPath, 
  Mtime, 
  Size, 
  Data
FROM glob(globs='C:\Windows\System32\drivers\etc\hosts*')
WHERE Mtime > now() - TimeSpan(7 Days) // Look for recent changes

SELECT 
  Name, 
  CommandLine, 
  Exe, 
  CreateTime
FROM pslist()
WHERE Name =~ 'netsh.exe' 
   AND CommandLine =~ 'proxy' // Detect active proxy configuration changes

Remediation Script (PowerShell)

Use this script to audit and reset proxy settings on endpoints that may have been manipulated by the malicious network infrastructure or secondary payloads.

PowerShell

# Audit and Reset Proxy Settings - Response to Midnight Blizzard Campaign
# Run as Administrator

Write-Host "[+] Checking current WinHTTP Proxy Configuration..."
$winhttp = netsh winhttp show proxy
Write-Host $winhttp

Write-Host "[+] Checking System Proxy Settings via Registry..."
$proxyEnable = Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Name "ProxyEnable" -ErrorAction SilentlyContinue
$proxyServer = Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Name "ProxyServer" -ErrorAction SilentlyContinue

if ($proxyEnable.ProxyEnable -eq 1) {
    Write-Host "[!] WARNING: Proxy is Enabled. Server: $($proxyServer.ProxyServer)" -ForegroundColor Red
    Write-Host "[+] Disabling System Proxy..."
    Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Name "ProxyEnable" -Value 0
    Write-Host "[+] Proxy Disabled for Current User."
} else {
    Write-Host "[+] No System Proxy detected for HKCU."
}

# Check Machine level settings
$machineProxy = Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" -Name "ProxyEnable" -ErrorAction SilentlyContinue
if ($machineProxy.ProxyEnable -eq 1) {
    Write-Host "[!] WARNING: Machine-wide Proxy is Enabled." -ForegroundColor Red
}

Write-Host "[+] Resetting WinHTTP Proxy to Direct Access..."
netsh winhttp reset proxy

Write-Host "[+] Remediation Complete. Please advise user to change M365 password and revoke sessions."

Remediation

Identity Hygiene: Immediately revoke all active refresh tokens for users identified as affected. Force a password reset and require re-registration of MFA methods.
Conditional Access (CA): Enforce strict CA policies. Implement "Location-based" conditions to block sign-ins from high-risk countries or unknown geolocations if business operations allow.
Network Security: Mandate the use of Enterprise VPNs for all employees traveling. Ensure VPN tunnels establish before any authentication to cloud services occurs.
Session Protection: Deploy Continuous Access Evaluation (CAE) policies in Microsoft Entra ID to limit the lifetime of sensitive sessions.
Machine Isolation: If a device was connected to the compromised network during the infection window, treat it as potentially compromised and perform a full forensic scan or re-image.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub