Russia-Linked Hackers Exploit Hotel Wi-Fi Networks for Corporate Secrets

Russian state-backed hackers have been targeting public Wi-Fi networks at hotels and conference centers worldwide using artificial intelligence to support their operation, according to Microsoft.

The campaign, named CaptiveCrunch, has been operating since early May, with the goal of stealing login credentials from corporate and government business travelers, Kyiv Post reported.

Microsoft Threat Intelligence attributed the campaign to a group tracked as Storm-2945, which is reportedly an operational sub-cluster of Midnight Blizzard, a threat actor linked to Russia’s Foreign Intelligence Service (SVR).

The hackers exploited hotel Wi-Fi registration pages and manipulated DNS and HTTP traffic to redirect guests through infrastructure under their control. Once redirected, victims received fake update prompts that delivered malware, including the Windows remote access trojan called CornFlake.