SentinelOne and ReversingLabs Say APT29's CaptiveCrunch Operators Spoofed Name Lookups From Inside Victims' Wi-Fi Segments and Cycled Five Stager Builds in 25 Days

LONDON - SentinelOne said on Oct. 16, 2026 that when it traced APT29's CaptiveCrunch campaign across customer environments in three regions, it found the adversary answering name lookups from inside the same local network segment as the victims' laptops, a detail the company says no public account of the campaign describes. Microsoft disclosed CaptiveCrunch on July 31 and attributes it to Storm-2945, which it assesses is an operational sub-cluster of Midnight Blizzard, the group the U.S. and U.K. governments attribute to Russia's Foreign Intelligence Service, or SVR. Microsoft described the attackers manipulating DNS and HTTP traffic on hospitality and other captive-portal Wi-Fi networks to push fake updates and Microsoft 365 phishing at travelers, and updated its report on Oct. 5 to say Storm-2945 resumed the campaign on Sept. 29 with a Rust variant of its CornFlake implant. On Oct. 15, ReversingLabs published how it expanded the two malware hashes Anthropic released in September for an operator it calls GTG-20006 into a wider map of the same operation: a staging server, five builds of a PowerShell stager, two lure shortcuts and domain-to-server links that it says are absent from Anthropic's indicator appendix.

SentinelOne's evidence is in the protocol. Its DnsPoison indicator recorded LLMNR responses on UDP port 5355 carrying the adversary's address on roughly a third of affected hosts, in reply to queries for randomized canary hostnames. Because LLMNR is link-local multicast that does not cross routers, the company concludes that a Responder-style spoofer was sitting on the shared network and that no DNS server in the chain was compromised. From that position the spoofer raced the legitimate resolver, replaying the genuine CNAME chain and rewriting only the final A record. Clean and poisoned answers for the same domain interleaved seconds apart, and success rates ranged from 5.6% to 84% depending on the network. Windows then delivered the lure itself: when its plain-HTTP connectivity check gets an unexpected reply, it assumes a captive portal and opens the default browser, which landed on the attacker's page. The payload was a browser updater matched to the victim's own browser. Microsoft documented ClickFix-style lures in this campaign; SentinelOne said it saw none on its endpoints, where downloading and launching the file was manual every time. Console screenshots in its post, dated July 9, show Microsoft's connectivity-test host resolving to 38.146.28.75, an address Microsoft lists as CaptiveCrunch adversary-in-the-middle infrastructure.

The payload was CornFlake, a Go remote access trojan that deploys ChocoShell, a PowerShell stealer that runs only in memory. Microsoft's analysis lists keylogging, webcam and microphone capture, a bypass for Chrome's App-Bound Encryption and theft of Microsoft 365 and Entra ID tokens from the Token Broker cache. SentinelOne, which uses the post to promote its on-device Static AI engine, says its agent convicted every delivered copy before it could run, including a partially downloaded .crdownload file, and killed and quarantined one launch attempt in under 100 milliseconds. It found no process creation from Downloads, no persistence, no lateral movement and no post-incident C2 contact. The harder finding for defenders sits on the identity side. SentinelOne counted 49 POST requests to Microsoft's OAuth token endpoint issued while the Microsoft login domain was resolving to the adversary; on one endpoint they began roughly 24 hours before any payload arrived, on another ten minutes before. Roughly half of the affected endpoints saw poisoning and no payload at all, which the company calls a reasonable sign that the malware was never the sole objective. Endpoint telemetry records a request's intended destination, not the outcome of the TLS handshake, so SentinelOne says it cannot confirm what happened to those requests.

ReversingLabs supplies the infrastructure picture. It says both seed files were in its telemetry before any public report, the Go backdoor from July 6 and the stager from July 10, weeks ahead of Microsoft's July 31 report and Anthropic's Sept. 10 publication. Content extraction led to the staging server at 213.145.86.112 and its /t/pixel.gif beacon path. A YARA rule on the operator's beacon labels returned seven PowerShell files in a retro-hunt, among them five rebuilt stagers with five different hashes that arrived between July 9 and Aug. 3. ReversingLabs calls that 25-day window consistent with Anthropic's account of an operator using Claude to rebuild implants once security products flagged them, while noting that its data cannot show what produced the builds. Two 60-byte Windows Internet Shortcut files that simply open stager paths on the server were flagged by none of 37 antivirus engines. Reputation lagged badly: of 14 servers Anthropic listed, 13 were flagged by 0 to 5 of roughly 49 sources when ReversingLabs checked in late September, and the staging server was still serving a malicious stager on Oct. 5, eight weeks after Microsoft's report. The company also cautions that no file it found should be called Midnight Blizzard malware on its authority alone.

For SOC teams, both companies argue against waiting on indicator reputation. SentinelOne's first host control is to disable LLMNR, which it calls the best and bluntest fix because it removes the protocol the adversary answers on. Its primary hunt, meant to run on a schedule rather than as a detection rule, groups DNS answers by public address, reduces each queried name to its registrable domain and counts distinct unrelated owners per address. A CDN answers for many domains owned by one organization; the adversary's address answered for Adobe, Apple, Akamai, AnyDesk, BeyondTrust, Brother, Microsoft and roughly 128 others. In a test against about 10,000 addresses and domains from affected environments, the hunt surfaced two addresses, both the adversary's, and found nearly a third of the endpoints SentinelOne confirmed, none of which an alert had flagged. Counting raw answers instead fired on 389 of 9,375 addresses, led by Azure Front Door and Cisco Umbrella. Supporting signals include LLMNR responses carrying non-RFC1918 addresses, wpad resolving to a public address, the connectivity-check URL in a browser command line followed within 60 seconds by an executable or .crdownload in Downloads, and failed _ldap._tcp lookups for the organization's own domain controllers. Microsoft's report adds a Defender hunting query for files created within two minutes of a Network Connectivity Status Indicator check, plus infrastructure seen in September and October, including cdn-gstat.com, sslcdnhost.com, network-privacy.com, 154.29.75.245 and 149.3.170.186. ReversingLabs publishes YARA and Sigma rules and advises querying every vendor report's indicators against historical telemetry the day it lands. SentinelOne advises reviewing sign-ins from unfamiliar infrastructure, anomalous token issuance and unexpected device registrations for any traveler with a suspected exposure window, and Microsoft and ReversingLabs both recommend blocking the device-code flow with Conditional Access where the business allows it.