Russia State-Sponsored Hackers Turn Hotel and Conference Wi-Fi Networks Into Malware Delivery Systems

Russian state backed hackers are compromising public Wi-Fi infrastructure at hotels, conference centres and other shared venues to intercept travellers’ internet traffic, distribute remote-access malware and steal access to corporate cloud accounts, according to new research from Microsoft.

The campaign, which Microsoft calls CaptiveCrunch, has been attributed to Storm-2945, an operational subgroup of Midnight Blizzard—the long-running cyberespionage operation also known as APT29, Cozy Bear and Nobelium. The United States and United Kingdom have previously linked Midnight Blizzard to Russia’s Foreign Intelligence Service, the SVR.