Microsoft Exposes Global Hotel Network Hack

Microsoft has uncovered a large-scale cyberattack by Storm-2945, a subgroup of the Midnight Blizzard (Nobelium) hacking group. The campaign, dubbed CaptiveCrunch, targeted hotel sector networks worldwide.

The attackers used an Adversary-in-the-Middle (AitM) method to redirect users through their controlled phishing infrastructure. They also distributed malicious software disguised as browser or operating system updates in response to automatic connection requests sent by users' browsers.

Several variants of malware were distributed, including full-fledged Remote Access Trojans (RATs) for Windows, written in Golang. These RATs allow attackers to collect system information, files, and keystroke data, steal credentials and session tokens, conduct audio and video surveillance, track removable media, and gain remote access to infected systems.

Microsoft notes that Midnight Blizzard is linked to Russia's Foreign Intelligence Service, according to the US and UK.