# Russia-Linked 'Midnight Blizzard' Compromises Hotel Wi-Fi Networks Globally Traveling employees targeted through fake software updates to steal credentials. - **Source:** [Slashdot](https://brifing.si/source/0f34d58e-1ccd-45a6-ab82-2de4065dc7ad) - **Published:** 2026-08-04 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/19c7703f-26ff-43b4-a02e-98f653e18a43 ## Midnight Blizzard's Target The Russia-linked Midnight Blizzard group has compromised hotel and conference Wi-Fi portals worldwide, redirecting guests to phishing pages. Fake software updates steal users' credentials, session tokens, and other sensitive data. Microsoft's analysis indicates the campaign broadly targets traveling employees rather than focusing on specific industries. ## Attack Origins Midnight Blizzard is attributed by US and UK governments to Russia's SVR foreign intelligence service. Microsoft's technical analysis confirms attacks occurred in 'several countries' without specifying locations. Security firm ReliaQuest's July report identified compromised captive portals in US, Indian, and Saudi Arabian hotels. ## Malware Tools Deployed Attackers use two main tools: CornFlake, a Go-written Windows RAT capable of keylogging, screen/webcam capture, audio surveillance, and credential theft. ChocoShell is a PowerShell-based infostealer targeting browser cookies, saved passwords, Microsoft 365 SSO tokens, and Wi-Fi credentials. Both tools demonstrate advanced capabilities. ## Android Devices at Risk Microsoft warns of indications that attackers may target Android devices through similar tactics, prompting victims to download malicious APK files. This expands the threat to mobile-using business travelers. Companies are advised to update travel policies and mobile security protocols to address this emerging vector. ## Affected Industries ReliaQuest's traffic observations show victims spanning financial services, professional services, legal, healthcare, energy, and retail sectors. This confirms the campaign's cross-industry nature, putting all traveling professionals at risk. Frequent travelers like executives and IT personnel face particularly high exposure. ## Corporate Risk Mitigation Experts recommend urgent security measures for traveling employees: mandatory VPN use, multi-factor authentication, heightened Wi-Fi vigilance, and mobile security software. Updating cybersecurity awareness training is critical. These steps form essential defenses against increasingly sophisticated hotel network compromises. ## Historical Context Midnight Blizzard (formerly NOBELIUM) is associated with the 2020 SolarWinds attack, with a history of sophisticated cyber-espionage operations. This latest campaign demonstrates evolving tactics. Cybersecurity professionals warn of potential increases in similar attacks, requiring continuous defensive adaptation. ## Broader Implications Beyond individual data breaches, these attacks threaten corporate secrets and strategic information. For energy and financial sector organizations, risks extend to national security dimensions. Experts call for international cooperation to combat such cyber threats through coordinated intelligence sharing and response protocols. ## Sources covering this story - https://yro.slashdot.org/story/26/08/04/0523203/russia-linked-midnight-blizzard-group-hijacks-hotel-wi-fi-with-captivecrunch?utm_source=rss1.0mainlinkanon&utm_medium=feed — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._