Storm-2945Threat actor
Storm-2945 is a sub-cluster of Midnight Blizzard conducting targeted traffic manipulation attacks on hospitality sector networks served by captive portals, leveraging doppelganger domains for AitM phishing and malware delivery. Their operations include AI-augmented device code and OAuth code phishing campaigns leading to Entra device registration and data collection from Microsoft 365.From MISP Galaxy
Last reported 27 days ago, by CERT-EU6 reports
ATT&CK techniques
6 of 11 · each with the sentence it comes from- T1684Social Engineering
“These clusters engage in persistent, adaptive phishing campaigns, using sophisticated social engineering tactics to compromise personal accounts across multiple platforms.”
- T1056.001Keylogging
“It carries keylogging, screenshots, microphone and webcam surveillance, browser credential theft and a remote shell, plus a watchdog routine that restores any persistence mechanism defenders remove.”
- T1195Supply Chain Compromise
“… APT Threat Trends report summarizes attack cases in which state-sponsored threat actors combined attacks involving open-source supply chain compromises, the use of generative AI, the exploitation of legitimate cloud services, job scams, and the exploitation of zero-day vulnerabi…”
- T1014Rootkit
“…able Roundcube servers to relay C2 traffic and also exploited CVE-2026-68820, a zero-day vulnerability in Windows to deploy a FudModule rootkit.”
- T1036Masquerading
“secure file sharing) and/or the organization UNC7005 is masquerading as.”
- T1053.005Scheduled Task
“CornFlake implements persistence through service registration, Registry Run keys, scheduled tasks, and a watchdog routine.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
6 reports, newest first · the exact sentence from each-
Cyber Brief 26-09 - August 2026“On July 31, Microsoft reported Storm-2945, a sub-cluster of Midnight Blizzard, conducting CaptiveCrunch attacks by manipulating traffic on hospitality captive portal networks worldwide.”
-
From guidance to action: Security fundamentals that materially reduce risk“Microsoft Threat Intelligence recently observed Storm-2945, a subcluster of Midnight Blizzard, manipulating DNS and HTTP traffic across hospitality networks in the CaptiveCrunch campaign.”
-
August 2026 Threat Trend Report on APT Groups“Storm-2945 manipulated captive portal networks at hotels, conferences, and airports to steal Microsoft 365 accounts and tokens and distribute CornFlake and ChocoShell.”
-
Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia“UNC7005 (aka STORM-2945) is a threat cluster identified in February 2026 that primarily targets academia, diplomatic, and nonprofit personnel across Ukraine, Western Europe, and the US Although this group shares many high-level similarities with UNC6293, including targeting overl…”
-
CaptiveCrunch: Midnight Blizzard Weaponizes Hotel Wi-Fi Captive Portals to Steal Microsoft 365 Credentials“Microsoft attributes this activity to Storm-2945, a sub-cluster of Midnight Blizzard (also known as APT29, Cozy Bear, NOBELIUM, and BlueBravo), a threat group linked to Russia.”
-
Midnight Blizzard Targets Travelers via Captive Portals“… by Microsoft Threat Intelligence on July 31, the campaign, which it named CaptiveCrunch, has run since early May and is attributed to Storm-2945, a sub-cluster of Midnight Blizzard.”
Indicators in its reports
named in the reports above- ms365-device[.]comin 2 reports
- ms365-live[.]comin 2 reports
- m365-owa[.]comin 2 reports
- owa-ms365[.]comin 2 reports
- 31.57.243[.]154in 2 reports
- 38.146.28[.]75in 2 reports
- 104.194.159[.]150in 2 reports
- be99857449d2856d…6b4970d8d42cin 2 reports
- 38.146.28[.]132in 1 report
- 107.189.26[.]194in 1 report
- 213.145.86[.]112in 1 report
- 918fa52ae45ed60b…4513be11c593in 1 report
- fewfwfwfwfwf[.]infoin 1 report
- 196.251.107[.]171in 1 report
- foreignrelations[.]usin 1 report
- 5b8d50c2e8cc3038…191ae67f8ffcin 1 report
- 1d9299799a7b8da6…3f6cbc843e3cin 1 report
- 107.189.18[.]7in 1 report
- c5826032207d623a…54f3e4420265in 1 report
- my-invite[.]orgin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.