Storm-2945
- Profile updated
- 2026-08-07 03:00:04
Context
Storm-2945 is a sub-cluster of Midnight Blizzard conducting targeted traffic manipulation attacks on hospitality sector networks served by captive portals, leveraging doppelganger domains for AitM phishing and malware delivery. Their operations include AI-augmented device code and OAuth code phishing campaigns leading to Entra device registration and data collection from Microsoft 365. The primary malware used is CornFlake, a Windows RAT that features customizable capabilities for data collection and evasion. Storm-2945 also utilizes the FruitStone web-based C2 panel to manage their campaign infrastructure and compromised endpoints.
Reports & references
- Microsoft — Captivecrunch Midnight Blizzard Targets Travelers Worldwide For Malware Delivery And Credential Theft (report)