APT / state · Fri 31 Jul 2026 · 21:01 UTC
CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft
Filed UTCSource MSF ↗
Storm-2945, a sub-cluster of the Russian threat actor Midnight Blizzard, has been observed compromising the sign-in portals of hospitality-related organizations such as hotels since May 2026 in order to deliver malware to travelers and steal credentials in an operation we call CaptiveCrunch.
Indicators
checking abuse.ch ThreatFoxChecking indicators against ThreatFox…
Get the next one first.
Every dispatch goes to Telegram and RSS the moment it is published, and the whole wire is a keyless JSON API.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.