Storm-2945 Uses Hotel Wi-Fi to Spread CornFlake RAT

Executive Summary

A new threat campaign tracked as "CaptiveCrunch" is actively targeting travelers, particularly those staying in hotels, by compromising Wi-Fi captive portals. The threat actor, identified by Microsoft as Storm-2945, uses these compromised portals to display fake browser update prompts. Unsuspecting users who download and run the fake update are infected with a Remote Access Trojan (RAT) named CornFlake. This malware is designed for surveillance and credential theft, capable of capturing webcam images, logging keystrokes, and stealing access tokens for Microsoft 365 and Azure AD, which can be used to bypass multi-factor authentication. The campaign represents a significant threat to business travelers and the security of corporate data.

Threat Overview

The CaptiveCrunch campaign leverages a trusted, yet often insecure, point of entry: public Wi-Fi. The attack begins when a user connects to a compromised hotel Wi-Fi network. Instead of the legitimate login page, the user is presented with a convincing but fake browser update notification (e.g., for Chrome or Firefox) overlaid on the captive portal page. This social engineering tactic preys on users' habits of accepting prompts to get online.

If the user downloads and executes the malicious file, the CornFlake RAT is installed. The malware's capabilities include:

• Surveillance: Capturing webcam images, recording microphone audio, and logging keystrokes.
• Credential Theft: Stealing access and refresh tokens for Microsoft 365, Azure Active Directory (Azure AD), and Web Account Manager (WAM).

Notably, the stolen tokens allow the attacker to replay a user's authenticated session, effectively bypassing MFA. The campaign has also evolved to use a novel technique where some landing pages redirect users to Microsoft's legitimate device code authentication flow. The page instructs the user to enter a code supplied by the attacker, which grants Storm-2945 an MFA-satisfied session on the user's account.

Security researchers at ReliaQuest had previously noted the infrastructure's resemblance to that of APT28 (Fancy Bear), a Russian GRU unit, though firm attribution has not been made.

Technical Analysis

The CaptiveCrunch attack chain can be mapped to the MITRE ATT&CK framework:

• Initial Access: T1189 - Drive-by Compromise: The user is compromised by interacting with the malicious captive portal, a form of drive-by attack.
• Execution: T1204.002 - Malicious File: The user is tricked into executing the fake browser update installer.
• Defense Evasion & Privilege Escalation: T1548.002 - Bypass User Account Control: The malware likely attempts to bypass UAC to gain higher privileges.
• Credential Access:
  • T1528 - Steal Application Access Token: A primary objective of the CornFlake RAT is to steal M365 and Azure AD tokens.
  • T1555.003 - Credentials from Web Browsers: The RAT likely also scrapes saved credentials from browsers.
• Collection:
  • T1056.001 - Keylogging: To capture typed information like passwords and sensitive messages.
  • T1123 - Audio Capture: Recording microphone audio.
  • T1125 - Video Capture: Capturing webcam images.
• Impact: The abuse of the device code authentication flow is a sophisticated technique to gain persistent, MFA-bypassing access to cloud accounts.

Impact Assessment

The primary victims are individuals using hotel Wi-Fi, with a high risk for business travelers, executives, and government employees who may handle sensitive data. The impact includes:

• Corporate Data Breach: Theft of M365/Azure AD tokens can grant attackers access to corporate email, SharePoint, OneDrive, and other sensitive cloud resources.
• Espionage: The extensive surveillance capabilities of the CornFlake RAT are ideal for industrial or state-sponsored espionage.
• Identity Theft: Stolen credentials and personal information can be used for financial fraud or identity theft.
• Supply Chain Risk: Microsoft's finding that common equipment and management systems were used across affected hotels suggests a potential compromise of a shared service provider, indicating a supply chain vulnerability within the hospitality technology ecosystem.

IOCs — Directly from Articles

No specific Indicators of Compromise (e.g., IP addresses, file hashes, or domains) were provided in the source articles.

Cyber Observables — Hunting Hints

Security teams may want to hunt for the following patterns to detect related activity:

Detection & Response

• Endpoint Detection: EDR solutions should be configured to detect the installation and execution of the CornFlake RAT. Look for processes that attempt to access browser token stores, capture audio/video, or log keystrokes.
• Cloud Account Monitoring: Use tools like Microsoft Sentinel or Entra ID Identity Protection to monitor for anomalous sign-in behavior, such as impossible travel, unfamiliar locations, or session token replay. Alerts for device code flow authentications from untrusted networks should be prioritized.
• Network Monitoring: While difficult on public Wi-Fi, corporate VPN solutions can provide visibility. Monitor for connections to known malicious C2 infrastructure.

Mitigation

• User Training: The most critical defense. Train users to never download or install software, especially browser updates, from a captive portal pop-up. Legitimate updates are handled by the browser itself or by corporate device management.
• Use Secure Connections: Advise employees to avoid public Wi-Fi for business purposes. Instead, they should use a corporate VPN, a personal hotspot (cellular data), or a trusted private network.
• Enforce MFA: While this attack can bypass some forms of MFA, phishing-resistant methods like FIDO2 security keys are not vulnerable to token theft or device code abuse.
• Device Hardening: Use application control to prevent the execution of unauthorized software. Ensure endpoint security software is installed and up-to-date on all corporate devices.