Storm-2945 'CaptiveCrunch': Hotel Wi-Fi DNS Hijacking and M365 Token Theft Defense

Introduction

Since early May 2026, a sophisticated cyber-espionage campaign dubbed CaptiveCrunch has been actively targeting business travelers. Microsoft Threat Intelligence attributes this operation to Storm-2945, a sub-cluster of the notorious Russian state-sponsored group Midnight Blizzard (APT29, Cozy Bear). By hijacking hotel Wi-Fi portals and manipulating DNS configurations, these actors are intercepting connections to deliver malicious software designed specifically to harvest Microsoft 365 authentication tokens. This bypasses traditional multi-factor authentication (MFA) controls and grants the attackers persistent access to corporate environments. For defenders, this represents a critical shift in attack surface: the physical infrastructure of third-party hospitality providers has become the initial access vector for enterprise compromise.

Technical Analysis

The CaptiveCrunch campaign illustrates a high-risk evolution in "adversary-in-the-middle" (AITM) tactics. Unlike standard phishing, this attack leverages the inherent trust users place in captive portals—the web pages that require authentication or acceptance of terms before granting internet access.

Attack Vector: Storm-2945 compromises the hotel's network infrastructure or the specific Wi-Fi access points serving high-value targets (e.g., conference attendees, executives). Once inside the network segment, they manipulate the DNS settings to redirect traffic intended for legitimate Microsoft 365 or update servers to attacker-controlled infrastructure.
Payload Delivery: When the victim's device attempts to communicate—often triggered by a software update or a background sync process—it is served malicious content instead of the legitimate file. This payload is tailored to evade detection by endpoint security solutions that may classify network traffic from a hotel Wi-Fi as low-priority or risky.
Objective: The primary goal is the theft of Microsoft 365 Refresh Tokens. By accessing the token stores on the endpoint (often within browser caches or the Windows Credential Manager), the actors can generate new access tokens without needing the user's password or satisfying MFA prompts again. This allows them to maintain persistence inside the victim's corporate tenant even after the device leaves the hotel network.

Affected Products/Platforms:

Microsoft 365 (Enterprise): Targeted via token theft.
Windows 10/11: Endpoints where token storage is accessed.
Captive Portal Infrastructure: Third-party Wi-Fi management systems.

Exploitation Status:

Active Exploitation: Confirmed in-the-wild by Microsoft Threat Intelligence as of May 2026.
Threat Actor: Midnight Blizzard (APT29 / SVR).

Detection & Response

Detecting this attack requires a multi-layered approach. Traditional perimeter defenses are ineffective here because the victim is outside the corporate perimeter. Detection must focus on endpoint anomalies (token access) and network-layer indicators of DNS manipulation.

SIGMA Rules

The following Sigma rules target the key TTPs: unauthorized access to the Windows WebCache (where M365 tokens are often stored) and suspicious DNS modifications.

YAML

---
title: Suspicious Access to M365 Token Storage WebCache
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects processes accessing the Windows WebCache file (WebCacheV01.dat) which is frequently targeted to steal M365 refresh tokens. Access by non-browser processes is highly suspicious.
references:
 - https://attack.mitre.org/techniques/T1552/001/
author: Security Arsenal
date: 2026/05/12
tags:
 - attack.credential_access
 - attack.t1552.001
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename|contains: '\WebCacheV01.dat'
  filter_legitimate:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\svchost.exe'
condition: selection and not filter_legitimate
falsepositives:
  - Backup software accessing user profiles
  - Antivirus/EDR scanning
level: high
---
title: Suspicious DNS Server Configuration Change via PowerShell
id: 9b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects commands attempting to set the DNS server address on network interfaces, often used by malware to force traffic through malicious DNS resolvers or to maintain DNS poisoning on the endpoint.
references:
 - https://attack.mitre.org/techniques/T1071/004/
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.defense_evasion
  - attack.t1071.004
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'Set-DnsClientServerAddress'
      - 'netsh interface ip set dns'
  condition: selection
falsepositives:
  - IT administration scripts
  - VPN client configuration scripts
level: medium

KQL (Microsoft Sentinel / Defender)

This query hunts for processes reading the WebCache file, a strong indicator of credential dumping activity associated with this campaign.

KQL — Microsoft Sentinel / Defender

DeviceFileEvents
| where FolderPath endswith @"\Microsoft\Windows\WebCache\WebCacheV01.dat"
| where InitiatingProcessFileName !in ("chrome.exe", "msedge.exe", "firefox.exe", "svchost.exe", "dllhost.exe")
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath
| order by Timestamp desc

Velociraptor VQL

This VQL artifact hunts for open handles to the WebCache file, which can capture stealthy access that might not trigger file creation events.

VQL — Velociraptor

-- Hunt for processes holding handles on the WebCache file
SELECT Pid, Name, CommandLine, exe, Username
FROM handles()
WHERE Name =~ "WebCacheV01.dat"
  AND Name !~ "\\chrome.exe"
  AND Name !~ "\\msedge.exe"
  AND Name !~ "\\svchost.exe"

Remediation Script (PowerShell)

Use this script on potentially compromised endpoints to flush the DNS cache (removing malicious entries), reset DNS settings to DHCP defaults, and audit the M365 token storage location for recent modifications.

PowerShell

# Remediation Script: CaptiveCrunch Response
# Run as Administrator

Write-Host "[+] Starting CaptiveCrunch Remediation Steps..." -ForegroundColor Cyan

# 1. Flush DNS Resolver Cache to clear poisoned entries
Write-Host "[*] Flushing DNS Resolver Cache..."
Clear-DnsClientCache

# 2. Reset DNS Interface Settings to DHCP (removes static rogue DNS)
Write-Host "[*] Resetting Interface DNS settings to DHCP default..."
Get-NetAdapter | Where-Object { $_.Status -eq "Up" } | ForEach-Object {
    Set-DnsClientServerAddress -InterfaceAlias $_.Name -ResetServerAddresses
}

# 3. Identify M365 Token Storage File Modification (Last 24 hours)
Write-Host "[*] Checking for recent modifications to M365 Token Store..."
$webCachePath = "$env:LOCALAPPDATA\Microsoft\Windows\WebCache\WebCacheV01.dat"
if (Test-Path $webCachePath) {
    $file = Get-Item $webCachePath
    $timeDiff = (Get-Date) - $file.LastWriteTime
    if ($timeDiff.TotalHours -le 24) {
        Write-Host "[!] WARNING: WebCacheV01.dat modified within last 24 hours:" $file.LastWriteTime -ForegroundColor Red
        Write-Host "[!] ACTION: Revoke user sessions in M365 Admin Center immediately."
    } else {
        Write-Host "[+] No recent modifications to WebCache detected."
    }
} else {
    Write-Host "[-] WebCache file not found."
}

Write-Host "[+] Remediation complete. Please enforce VPN usage and review M365 sign-in logs." -ForegroundColor Green

Remediation

Immediate and decisive action is required to contain the threat of token theft:

Session Revocation (Critical): If a device is suspected of being compromised on a hotel network, immediately revoke all active refresh tokens for the affected user in the Microsoft Entra admin center. This forces re-authentication and renders the stolen tokens useless.
Network Isolation: Instruct traveling employees to treat hotel Wi-Fi as hostile. Mandate the use of always-on VPNs to tunnel all traffic back to the corporate secure gateway before it hits the internet, bypassing the hotel's DNS infrastructure entirely.
Device Hygiene: Run the PowerShell remediation script above on returning devices. Perform a full antivirus/EDR scan focusing on credential theft indicators.
Conditional Access: Enforce Strict Location-Based Conditional Access or device compliance policies that require devices to be managed (Intune) before accessing sensitive corporate data, reducing the risk of unmanaged personal devices falling victim to these portals.
User Awareness: Brief traveling staff on the specific risks of "captive portals." Advise them to avoid entering corporate credentials on generic hotel login pages and to verify HTTPS certificates if browser warnings appear.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub