Since early Could 2026, Microsoft Risk Intelligence has noticed Storm-2945, a sub-cluster of Midnight Blizzard, conducting widespread however focused visitors manipulation assaults involving hospitality sector networks served by captive portals worldwide. Regardless of some tactic, approach, and process (TTP) similarities to the Forest Blizzard DNS hijacking operation that we publicly disclosed in April 2026, we attribute this marketing campaign, which we name CaptiveCrunch, to Storm-2945. As reported by ReliaQuest on July 23, a portion of this exercise leverages doppelganger domains mimicking Microsoft on-line providers to conduct follow-on adversary-in-the-middle (AitM) phishing operations that abuse the machine code authentication move in Microsoft Entra ID. Microsoft Risk Intelligence has additionally recognized energetic visitors manipulation assaults resulting in the supply of malware on impacted programs. Microsoft has noticed Storm-2945 leveraging AI to help a good portion of those operations.
At present, we’re sharing our findings on these ongoing intrusions to boost consciousness of this menace and allow prospects to guard their units, particularly whereas touring. We offer our evaluation of Storm-2945’s relationship to Midnight Blizzard and evaluation of the CaptiveCrunch marketing campaign, detailing the malware and tradecraft utilized in these operations. We additionally present mitigation, detection, and looking steering to assist organizations determine and defend in opposition to Storm-2945 and associated exercise.
Microsoft Risk Intelligence wish to thank our companions at Anthropic and OpenAI for his or her collaboration and help throughout this investigation.
The CaptiveCrunch marketing campaign
Since February 2026, Storm-2945 has carried out AI-augmented operations together with focused machine code and OAuth code phishing campaigns resulting in Entra machine registration and subsequent knowledge assortment from Microsoft 365. Since early Could 2026, Microsoft Risk Intelligence has noticed Storm-2945 manipulating DNS and HTTP visitors from networks served by captive portals to redirect person visitors via actor-controlled infrastructure. Though our investigation into the preliminary compromise vector for the captive portal networks is ongoing, now we have noticed notable commonalities within the gear and administration programs used throughout a number of affected networks. These similarities recommend that the exercise may not be restricted to remoted compromises of particular person venues and will mirror entry to shared providers inside parts of the captive portal ecosystem.
As a part of the CaptiveCrunch marketing campaign, Storm-2945 has leveraged their AitM place to redirect customers via actor-controlled phishing infrastructure and has additionally delivered malware purporting to be browser or working system updates in response to automated connectivity checks issued by customers’ browsers. A number of variants have been delivered, together with fully-featured Home windows distant entry trojans (RAT) in compiled Golang, with performance to conduct system enumeration, accumulate recordsdata and keystrokes, steal credentials and session tokens, conduct audio and video surveillance, monitor for detachable media, and supply the menace actor a distant shell on contaminated programs.
The menace actor infrastructure leverages a wide range of ClickFix strategies to elicit the person into downloading and executing the malware:
Along with variants of malware concentrating on Home windows programs, Microsoft Risk Intelligence can also be conscious of indications that the menace actor could be concentrating on Android units with related strategies because the ClickFix landings additionally embody directions for Android units to obtain and set up an APK file.
To this point, Microsoft has recognized widespread compromise of Wi-Fi networks at hospitality-related organizations and different networks serviced by captive portal gear in a number of international locations. ReliaQuest has recognized this exercise not solely at inns, but additionally convention facilities and different shared venues, and assesses that the aim of this exercise is to entry the accounts of company vacationers.
Storm-2945 and Midnight Blizzard
Microsoft Risk Intelligence assesses that Storm-2945 is an operational sub-cluster of Midnight Blizzard based mostly on distinctive technical and operational overlaps. These embody technical similarities to Storm-2372, a Midnight Blizzard preliminary entry operations sub-cluster, additionally notable for his or her machine code and OAuth code phishing operations tracked all through 2025, Microsoft Graph-based electronic mail exfiltration, social engineering delivered by way of business messaging apps, and important similarities in victimology.
Midnight Blizzard is a Russia-based menace actor attributed by the US and UK governments to the Overseas Intelligence Service of the Russian Federation, often known as the SVR. This menace actor is thought to primarily goal governments, diplomatic entities, non-governmental organizations (NGOs), and data know-how (IT) service suppliers, primarily within the US and Europe. Midnight Blizzard is constant and protracted of their operational concentrating on, and their goals not often change. Their focus is to gather intelligence via longstanding and devoted espionage in help of Russian overseas coverage pursuits.
Midnight Blizzard operations typically contain compromise of legitimate accounts and, in some extremely focused circumstances, superior strategies to compromise authentication mechanisms inside a company to broaden entry and evade detection. They make the most of various preliminary entry strategies, and Midnight Blizzard can also be adept at figuring out and abusing OAuth functions to maneuver laterally throughout cloud environments and for post-compromise exercise, resembling electronic mail assortment.
CornFlake: Distant entry and infostealer implant
CornFlake is a full-featured Home windows RAT written in Go that serves as Storm-2945’s major persistent implant. Microsoft has noticed the menace actor quickly iterating on this malware layer, which options customizable capabilities from the social engineering person interface and knowledge assortment capabilities to anti-detection and evasion strategies.
On preliminary execution, CornFlake operates in dropper mode: it shows a convincing faux progress window designed to occupy the sufferer’s consideration whereas the binary copies itself to %APPDATApercentsvchost32svchost32.exe and establishes persistence.
Faux window choices configurable by the menace actor at construct time:
- winupdate — A Home windows Replace display screen displaying “Engaged on updates… Don’t flip off your laptop”
- defender — A Home windows Safety virus scan
- directx — A DirectX Finish-Consumer Runtime Internet Installer
- vcredist — A Microsoft Visible C++ 2015-2022 Redistributable installer
- sysopt — A disk optimization utility
- netfix — A Home windows Community Diagnostics software
- browser — A browser replace immediate
- pdfview — A doc viewer installer
CornFlake registers as a Home windows service named svchost32 with the show title “Cloud Sync Service” and outline “Synchronizes recordsdata with the cloud storage supplier”, intentionally mimicking the professional svchost.exe course of. It establishes redundant persistence mechanisms: Home windows service registrations, Registry Run keys, named scheduled duties, and a persistence watchdog routine that runs repeatedly to revive any persistence mechanism that’s eliminated by defenders or endpoint safety.
For command and management (C2), CornFlake performs an Elliptic Curve Diffie-Hellman (ECDH) P-256 ephemeral key change with the C2 server, derives a session key by way of SHA-256, and communicates over a customized JSON protocol framed inside the encrypted channel. This supplies an encrypted channel to the C2 server, with every C2 session utilizing a novel ephemeral key, making decryption of captured visitors unimaginable with out the session-specific personal key. The runtime configuration file sync.dat helps scorching reconfiguration of C2 servers, watched directories, file concentrating on patterns, and Transport Layer Safety (TLS) settings with out requiring redeployment.
As soon as established on a sufferer system, CornFlake supplies the operator with a complete assortment toolkit, gated by configuration flags that enable selective activation post-deployment:
| Functionality | Description |
| Keylogging | Uncooked enter API-based keylogger capturing all keystrokes, together with password fields |
| Clipboard monitoring | Captures clipboard adjustments with SHA-256 deduplication and information the energetic window title at time of seize |
| Screenshot seize | Idle-triggered and on-demand screenshots with configurable idle threshold |
| Audio surveillance | Home windows Audio Session API (WASAPI)-based microphone seize, encoded as WAV recordsdata |
| Video surveillance | Media Basis-based webcam seize, encoded as JPEG |
| Browser credential theft | ChromeKatz-derived module supporting dwell cookie extraction from course of reminiscence (Chromium browsers) and saved password extraction from on-disk databases, together with Chrome App-Certain Encryption (ABE) bypass and Firefox NSS/SDR decryption |
| File exfiltration | Targets recordsdata based mostly on file extensions with real-time file system monitoring and an add throttle (1,000 recordsdata or 500 MB per cycle). File extensions are categorized as Paperwork, Archives, Photographs, Code, Information, Emails, and Keys |
| USB drive monitoring | Detects and scans detachable media when inserted |
| Safety posture sweep | Collects 18 classes of host intelligence together with put in software program, antivirus (AV)/endpoint detection and response (EDR) merchandise, Defender exclusions, Consumer Account Management (UAC) degree, Distant Desktop Protocol (RDP) historical past, Workplace most just lately used (MRU) recordsdata, and credential hints |
| Distant shell | Arbitrary command execution by way of cmd.exe or PowerShell (with -NoP flag to suppress profile-based detection) |
CornFlake additionally exposes a localhost HTTP API server (/add, /reload, /standing) that transforms the RAT right into a modular platform: companion or next-stage payloads resembling ChocoShell may process file exfiltration, set off configuration scorching reloads or test C2 connectivity utilizing the pre-established safe C2 channel for communication.
ChocoShell: PowerShell infostealer
ChocoShell is the marketing campaign’s Powershell-based infostealer, delivered and executed fully in-memory. Its major goal is the high-volume theft of browser session cookies, saved passwords, Microsoft 365 Single Signal-On (SSO) tokens, and Wi-Fi credentials from compromised programs. The place CornFlake supplies the operator with a persistent, long-running foothold on the machine, ChocoShell is designed to extract essentially the most operationally helpful credentials, giving the operator entry to sufferer cloud environments.
The ChocoShell script was authored with full developer feedback that reveal the operator’s intent behind every code choice, together with express references to Microsoft detection signatures and the reasoning behind particular evasion decisions. The constant coding normal and descriptive commentary recommend the writer might need leveraged AI-assisted code era.
Protection evasion. Upon execution, ChocoShell beacons to a hardcoded C2 server at 213.145.86[.]112 and implements a number of evasion strategies in sequence. It disables the Antimalware Scan Interface (AMSI) by way of .NET reflection to forestall ScriptBlock scanning and evades Microsoft behavioral detection that triggers on suspicious PowerShell net request cmdlets. A timing-based sandbox detection test can also be employed as a digital machine (VM) detection mechanism, silently exiting with out performing any assortment if detected.
C2 communication. ChocoShell communicates with its C2 server utilizing HTTPS with URI paths designed to mix in with professional net visitors. Beacons use /t/pixel.gif?m=
Privilege escalation. ChocoShell requires administrative privileges for its most impactful capabilities: SYSTEM token impersonation for Chrome ABE decryption, Quantity Shadow Copy Service (VSS) shadow copy creation, Defender signature locking. It implements three silent UAC bypass strategies with ordered fallback:
- SilentCleanup process hijack: Writes a malicious command to HKCUEnvironmentwindir, then triggers the built-in SilentCleanup scheduled process, which resolves %windir% from the person’s atmosphere, executing the menace actor’s command at elevated privilege. The registry worth is cleaned up after two seconds to keep away from cloud detection.
- wsreset.exe COM hijack: Creates a COM handler key in HKCUSoftwareClasses and launches the auto-elevating Home windows Retailer reset software.
- sdclt.exe folder hijack: Hijacks HKCUSoftwareClassesFoldershellopencommand and launches the Home windows Backup utility with the /KickOffElev flag.
If not one of the silent bypasses succeed (for instance, the person shouldn’t be a neighborhood administrator), ChocoShell falls again to a visual UAC immediate by way of Begin-Course of -Verb RunAs. Notably, the script additionally comprises a variant designed to execute inside the WinGet Desired State Configuration (DSC) host course of (ConfigurationRemotingServer), suggesting an assault vector via malicious WinGet DSC configuration utilized in Home windows machine provisioning.
Credential and session theft. As soon as operating with elevated permissions, ChocoShell locks Defender signature updates and systematically harvests knowledge from a number of sources. For Chromium-based browsers (Chrome, Edge, Courageous, Opera, Opera GX, Vivaldi), it extracts the grasp encryption key from the browser’s Native State file, dealing with each the fashionable ABE scheme (Chrome v127+) and the legacy knowledge safety API (DPAPI)-only scheme. ABE decryption requires SYSTEM-level DPAPI entry, which the malware obtains by impersonating a SYSTEM course of token borrowed from winlogon.exe, wininit.exe, or providers.exe. Locked browser SQLite databases are accessed via three methods: shared file entry, Quantity Shadow Service snapshots, and direct copy as a fallback.
As a parallel assortment path, ChocoShell launches Chrome, Edge, and Courageous with the –remote-debugging-port flag and points Community.getAllCookies via the Chrome DevTools Protocol (CDP). This utterly bypasses ABE, enabling the browser to carry out its personal inside decryption and returns plaintext cookie values. To deal with privilege points (SYSTEM-launched browsers inherit the fallacious token), the malware creates transient scheduled duties with TASK_LOGON_INTERACTIVE_TOKEN to launch the browser beneath the signed-in person’s session. After extraction, the browser is stopped and relaunched with –restore-last-session to keep away from alerting the person.
For Firefox household browsers (Firefox, Waterfox, LibreWolf, Floorp, Zen), the malware copies unencrypted cookies.sqlite databases from every profile. Moreover, ChocoShell collects Microsoft 365 and Azure Energetic Listing (AD) entry tokens, refresh tokens, and Internet Account Supervisor (WAM) tokens from .tbres recordsdata within the Token Dealer cache. Assortment of those tokens represents a big menace to enterprise environments, as menace actors may replay SSO classes with out browser cookies. Moreover, Wi-Fi credentials are harvested by way of netsh wlan present profile with key=clear.
Exfiltration and cleanup. All collected knowledge is aggregated right into a JSON construction, GZip-compressed, Base64-encoded, and despatched by POST to the C2’s /t/occasion endpoint. After exfiltration, all collected knowledge variables are nulled, rubbish assortment is compelled, VSS shadow copies are deleted by way of Home windows Administration Instrumentation (WMI), non permanent elevation scripts are eliminated, and all UAC bypass registry keys (already cleaned throughout escalation) are verified eliminated.
FruitStone: Operator C2 panel
FruitStone is the web-based C2 panel that Storm-2945 operators use to handle all the CaptiveCrunch marketing campaign infrastructure. Carried out as a single-page software (HTML and JavaScript) serving because the front-end of the C2 server with all performance uncovered with out authentication, FruitStone supplies a centralized dashboard for managing compromised endpoints, constructing and deploying new marketing campaign payloads, and reviewing all collected knowledge (resembling screenshots, keystrokes, browser credentials).
Operational cowl. The panel is branded as “CloudSync Console” with a footer studying “Acuity Methods, Inc. — Cloud Infrastructure Portal v3.2.1,” designed to seem as professional enterprise cloud administration software program if the panel URL is found by defenders or internet hosting suppliers. This masquerading extends to the CornFlake agent’s service title (Cloud Sync Service) and outline (“Synchronizes recordsdata with the cloud storage supplier”), making a constant cowl story throughout the toolchain.
Session administration and multi-operator help. FruitStone makes use of JSON Internet Token (JWT)-based authentication, session revocation, and price limiting with IP blocking to forestall brute drive assaults in opposition to the panel check in. A number of operators could possibly be provisioned with particular person accounts, and all energetic classes are seen with IP tackle, user-agent, and creation time to allow operational safety consciousness throughout the operators.
Agent administration. The panel shows all registered CornFlake brokers in a dashboard with real-time standing updates by way of Server-Despatched Occasions (SSE). Every agent card reveals complete system info together with hostname, username, OS model, CPU, RAM, disk utilization, display screen decision, timezone, area membership, and digital camera/microphone presence, all collected through the CornFlake posture sweep. Brokers are grouped by nation and subnet, with geographic distribution visualized on a map.
Operators may work together with particular person brokers via:
- Distant shell — Interactive cmd.exe or PowerShell command execution with command historical past
- File system browser — Reside listing traversal and arbitrary file obtain from compromised hosts
- Assortment tasking — On-demand screenshot, course of checklist, keylog buffer flush, clipboard dump, safety posture survey, ChromeKatz cookie/password extraction, digital camera seize, and audio recording
- Configuration push — Reside runtime reconfiguration of C2 servers, watch paths, and C2 beacon timing
- Agent replace — In-place implant replace by pushing a brand new CornFlake construct to a operating agent
- Agent kill — Distant termination of the CornFlake implant
Marketing campaign builder. A step-by-step wizard permits operators to configure and construct new CornFlake payloads instantly from the panel:
- Identification — Marketing campaign ID, C2 host and port, HTTP base URL, executable file title (svchost32.exe by default), and dropper kind (C dropper at ~19 KB, Go stub at ~8 MB, or standalone self-installer)
- Capabilities — Toggle particular person assortment modules: screenshots, course of enumeration, keylogging, clipboard monitoring, posture survey, file exfiltration, and ChromeKatz browser credential theft
- File Paths — Configure focused directories and file extensions by class (paperwork, archives, photos, code, knowledge, emails, encryption keys)
- Evasion — Allow garble image randomization (for GoLang payloads), XOR string encoding, GZip add compression, and debug mode
Infrastructure administration. FruitStone supplies administration interfaces for 3 layers of supporting infrastructure:
- Proxy relays — Multi-proxy C2 relay structure with TLS certificates monitoring (fingerprint, expiry), well being checks, connection counts, bytes forwarded, and rotation capabilities that push up to date server lists to all on-line brokers
- Beacon profiles — Configurable timing profiles controlling agent sleep intervals, reconnection delays, TLS Server Identify Indication (SNI) spoofing (like groups.microsoft.com), and DNS fallback domains
- Staging servers — Exterior payload internet hosting infrastructure with push-to-deploy, file itemizing, and well being monitoring
Gadget code abuse for cloud entry
Since July 16, Microsoft has noticed a portion of CaptiveCrunch touchdown pages redirecting customers to machine code authentication move experiences. In these circumstances, customers served these landings could be instructed to enter a tool code right into a professional Microsoft sign-in web page, a method generally known as machine code phishing.
Gadget code authentication is a professional OAuth workflow designed for units that can’t help a standard sign-in expertise. Nonetheless, menace actors may abuse this move by initiating an authentication request on behalf of a person then convincing the person to enter an actor-controlled machine code right into a professional Microsoft authentication web page. When profitable, the sufferer authenticates the menace actor’s session relatively than their very own.
This exercise is in keeping with beforehand reported machine code phishing operations carried out by Midnight Blizzard since August 2024. The noticed approach doesn’t seem basically novel; nonetheless, integrating machine code phishing into captive portal and visitors manipulation operations would possibly enhance the chance that customers understand the authentication request as professional. For extra particulars on Midnight Blizzard-related machine code phishing strategies, see: Storm-2372 conducts machine code phishing marketing campaign. To know different menace actors’ use of machine code phishing and related mitigations, see Inside an AI‑enabled machine code phishing marketing campaign.
How one can shield in opposition to CaptiveCrunch exercise
Decrease belief in hospitality and visitor networks
When touring, customers ought to deal with lodge, convention, airport, and different visitor wi-fi networks as untrustworthy.
- Want personal connectivity (together with cellular hotspots, satellite tv for pc, and eSIM-based mobile knowledge connections) over public Wi‑Fi each time sensible.
- Think about using enterprise-managed journey routers or hotspot units that set up encrypted tunnels again to trusted company infrastructure earlier than accessing delicate sources.
- Keep away from downloading software program updates, certificates, browser updates, community troubleshooting instruments, or safety utilities introduced via captive portals or different sudden net prompts.
- Confirm replace requests via trusted working system mechanisms relatively than pop-up messages or web site prompts.
Strengthen id and entry controls
Organizations ought to assume that public and hospitality community infrastructure may not be reliable and will undertake controls that restrict publicity to visitors manipulation, credential theft, and machine code phishing.
- Educate customers to acknowledge ClickFix-style prompts, faux verification checks, and paste-and-run directions as malicious, particularly after they invoke command interpreters or script hosts resembling cmd.exe, PowerShell, rundll32.exe, or mshta.exe.
- Use passwordless options like passkeys and implement multifactor authentication (MFA).
- Solely enable machine code move the place crucial. Microsoft recommends blocking machine code move wherever doable. The place crucial, configure Microsoft Entra ID’s machine code move in your Conditional Entry insurance policies.
- Implement a sign-in danger coverage to automate response to dangerous sign-ins. An indication-in danger represents the chance {that a} given authentication request shouldn’t be licensed by the id proprietor. An indication-in risk-based coverage might be carried out by including a sign-in danger situation to Conditional Entry insurance policies that evaluates the danger degree of a selected person or group. Primarily based on the danger degree (excessive/medium/low), a coverage might be configured to dam entry or drive MFA.
- When a person is a excessive danger and Conditional entry analysis is enabled, the person’s entry is revoked, and they’re compelled to re-authenticate.
- For normal exercise monitoring, use Dangerous sign-in stories, which floor tried and profitable person entry actions the place the professional proprietor may not have carried out the sign-in.
- Use a Safety Service Edge (SSE) answer like International Safe Entry to safe entry to any app or useful resource utilizing community, id, and endpoint entry controls.
Cut back publicity throughout captive portal registration
Organizations ought to overview what info staff present to hospitality suppliers when connecting to visitor networks.
- Don’t reuse company credentials on lodge, convention, or guest-network registration pages.
- The place doable, organizations ought to consider whether or not venue-provided wi-fi is required for company occasions and conferences.
- Organizations ought to reduce pointless disclosure of worker identities, organizational affiliations, and journey particulars when reserving lodging or registering for visitor community entry, in keeping with company coverage and relevant native necessities.
Microsoft Defender detections and looking steering
Microsoft Defender prospects can check with the checklist of relevant detections beneath. Microsoft Defender coordinates detection, prevention, investigation, and response throughout endpoints, identities, electronic mail, apps to supply built-in safety in opposition to assaults just like the menace mentioned on this weblog.
Microsoft Defender for Endpoint detects Storm-2945 exercise beneath the detection Suspicious exercise linked to a Russian state-sponsored menace actor has been detected. Nonetheless, these alerts could be triggered by unrelated menace actor exercise. The next chart lists Microsoft Defender detections particular to the TTPs utilized by Storm-2945 on this assault.
| Tactic | Noticed exercise | Microsoft Defender protection |
| Preliminary entry | File obtain by way of captive portal redirection | Microsoft Defender for Endpoint – Suspicious downloaded file |
| Preliminary entry | ClickFix approach, faux browser or OS replace, preliminary file obtain | Microsoft Defender for Endpoint – Doable preliminary entry from an rising menace – Doable ClickFix exercise |
| Persistence | CornFlake registers a Home windows service, a Registry Run key, a scheduled process | Microsoft Defender for Endpoint – Suspicious Scheduled Process Course of Launched – Suspicious scheduled process – Suspicious file added to run key – Suspicious service registration Microsoft Entra ID Safety |
| Stealth/Protection evasion | ChocoShell disables AMSI | Microsoft Defender for Endpoint – Doable Antimalware Scan Interface (AMSI) tampering |
| Credential entry | ChocoShell’s theft of browser session cookies, saved passwords, Microsoft 365 SSO tokens, and Wi-Fi credentials. Gadget code abuse. | Microsoft Defender for Endpoint – Doable theft of passwords and different delicate net browser info – Suspicious DPAPI exercise Microsoft Defender For Identification Microsoft Defender XDR |
| Assortment | CornFlake monitoring and logging | Microsoft Defender for Endpoint – Exercise which may result in info stealer |
| Privilege escalation | ChocoShell UAC bypass strategies | Microsoft Defender for Endpoint – UAC bypass was detected – Doable Element Object Mannequin (COM) hijacking |
Microsoft Safety Copilot
Microsoft Safety Copilot is embedded in Microsoft Defender and supplies safety groups with AI-powered capabilities to summarize incidents, analyze recordsdata and scripts, summarize identities, use guided responses, and generate machine summaries, looking queries, and incident stories.
Prospects may also deploy AI brokers, together with the next Microsoft Safety Copilot brokers, to carry out safety duties effectively:
Safety Copilot can also be obtainable as a standalone expertise the place prospects can carry out particular security-related duties, resembling incident investigation, person evaluation, and vulnerability influence evaluation. As well as, Safety Copilot affords developer situations that enable prospects to construct, check, publish, and combine AI brokers and plugins to satisfy distinctive safety wants.
Risk intelligence stories
Microsoft Defender XDR prospects can use the next menace analytics stories within the Defender portal (requires license for not less than one Defender XDR product) to get essentially the most up-to-date details about the menace actor, malicious exercise, and strategies mentioned on this weblog. These stories present the intelligence, safety info, and really helpful actions to forestall, mitigate, or reply to related threats present in buyer environments.
Microsoft Safety Copilot prospects may also use the Microsoft Safety Copilot integration in Microsoft Defender Risk Intelligence, both within the Safety Copilot standalone portal or within the embedded expertise within the Microsoft Defender portal to get extra details about this menace actor.
Searching queries
Microsoft Defender XDR
Microsoft Defender XDR prospects can run the next superior looking queries to seek out associated exercise of their networks:
Detect file creation after Wi-Fi connectivity check on units
The next question checks for a file creation on a tool inside two minutes of the machine performing constructed‑in Community Connectivity Standing Indicator (NCSI) check, which happens when community connectivity is established to a Wi-Fi community with a captive portal. This exercise would possibly point out an attacker’s preliminary entry file presence on a tool.
Please be aware that not all recordsdata found via this question could be malicious or associated to this menace exercise.
let ncsi_endpoints = dynamic(["msftconnecttest.com","edge-http.microsoft.com","msftncsi.com","captive.apple.com","clients1.google.com",
"clients3.google.com","clients4.google.com","clients6.google.com","connectivitycheck.gstatic.com","connectivitycheck.android.com",
"android.clients.google.com","www.gstatic.com","detectportal.firefox.com","detectportal.brave-http-only.com","cloudflareportal.com",
"cloudflarecp.com","cloudflareok.com","connectivity-check.warp-svc","connectivity.cloudflareclient.com","spectrum.s3.amazonaws.com",
"nmcheck.gnome.org"]);
let NCSIEvents = DeviceNetworkEvents
| the place Timestamp > in the past(7d)
| the place RemoteUrl has_any (ncsi_endpoints)
| challenge NCSI_Timestamp = Timestamp, DeviceId, DeviceName, RemoteUrl, NCSI_ReportId = ReportId, NCSI_InitiatingProcessFileName = InitiatingProcessFileName, NCSI_InitiatingProcessCommandLine = InitiatingProcessCommandLine, NCSI_AccountName = InitiatingProcessAccountName;
let FileDownloadEvents = DeviceFileEvents
| the place Timestamp > in the past(7d)
| the place ActionType == "FileCreated"
| the place FileName has_any (".exe",".msi",".zip",".rar",".7z")
| challenge Download_Timestamp = Timestamp, DeviceId, FileName, FolderPath, Download_ReportId = ReportId, Download_InitiatingProcessFileName = InitiatingProcessFileName, Download_InitiatingProcessCommandLine = InitiatingProcessCommandLine, Download_AccountName = InitiatingProcessAccountName;
NCSIEvents
| be a part of sort=internal (
FileDownloadEvents
) on DeviceId
| the place Download_Timestamp >= NCSI_Timestamp and Download_Timestamp <= NCSI_Timestamp + 2m
| challenge
NCSI_Timestamp,
Download_Timestamp,
DeviceName,
DeviceId,
RemoteUrl,
FileName,
FolderPath,
InitiatingProcessFileName = Download_InitiatingProcessFileName,
InitiatingProcessCommandLine = Download_InitiatingProcessCommandLine,
AccountName = Download_AccountName,
NCSI_ReportId,
Download_ReportId
Detect connectivity to Storm-2945 infrastructure
The next question checks for connectivity to Storm-2945 infrastructure noticed on this assault exercise.
let target_domains = dynamic(["ms365-device.com", "ms365-live.com", "m365-owa.com", "owa-ms365.com"]);
let target_ips = dynamic(["31.57.243.154", "38.146.28.75", "38.146.28.132", "104.194.159.150", "107.189.26.194", "213.145.86.112"]);
DeviceNetworkEvents
| the place RemoteUrl has_any(target_domains) or RemoteIP in (target_ips)
| challenge
Timestamp,
DeviceName,
DeviceId,
RemoteUrl,
RemoteIP,
LocalIP,
InitiatingProcessFileName,
InitiatingProcessCommandLine,
AccountName = InitiatingProcessAccountName,
ReportId
Detect CornFlake RAT presence on affected programs
The next question checks for the presence of the CornFlake RAT binary.
DeviceProcessEvents
| the place FolderPath == "%APPDATA%svchost32svchost32.exe"
or FolderPath endswith @"svchost32svchost32.exe"
| challenge Timestamp, DeviceName, DeviceId, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName, ReportId
Detect CornFlake RAT Home windows service registration
The next question checks for the CornFlake RAT Home windows service registration.
DeviceRegistryEvents
| the place RegistryKey has @"SYSTEMCurrentControlSetServicessvchost32"
| the place ActionType == "RegistryValueSet"
| the place (RegistryValueName == "DisplayName" and RegistryValueData == "Cloud Sync Service")
or (RegistryValueName == "Description" and RegistryValueData == "Synchronizes recordsdata with the cloud storage supplier")
| challenge
Timestamp,
DeviceName,
DeviceId,
RegistryKey,
RegistryValueName,
RegistryValueData,
ActionType,
InitiatingProcessFileName,
InitiatingProcessCommandLine,
InitiatingProcessAccountName,
ReportId
Microsoft Sentinel
Microsoft Sentinel prospects can use the TI Mapping analytics (a sequence of analytics all prefixed with ‘TI map’) to robotically match the malicious area indicators talked about on this weblog submit with knowledge of their workspace. If the TI Map analytics usually are not at the moment deployed, prospects can set up the Risk Intelligence answer from the Microsoft Sentinel Content material Hub to have the analytics rule deployed of their Sentinel workspace.
Detect community IP and area indicators of compromise utilizing ASIM
The next question checks IP addresses and area IOCs throughout knowledge sources supported by ASIM community session parser:
//IP checklist and area list- _Im_NetworkSession
let lookback = 30d;
let ioc_ip_addr = dynamic(["213.145.86.112"]);
let ioc_domains = dynamic(["213.145.86.112/t/pixel.gif", "213.145.86.112/cdn/chunks/polyfill-7e2b.min.js", "213.145.86.112/t/event"]);
_Im_NetworkSession(starttime=todatetime(in the past(lookback)), endtime=now())
| the place DstIpAddr in (ioc_ip_addr) or DstDomain has_any (ioc_domains)
| summarize imNWS_mintime=min(TimeGenerated), imNWS_maxtime=max(TimeGenerated),
EventCount=depend() by SrcIpAddr, DstIpAddr, DstDomain, Dvc, EventProduct, EventVendor
Detect net classes IP and file hash indicators of compromise utilizing ASIM
The next question checks IP addresses, domains, and file hash IOCs throughout knowledge sources supported by ASIM net session parser:
//IP checklist - _Im_WebSession
let lookback = 30d;
let ioc_ip_addr = dynamic(["213.145.86.112"]);
let ioc_sha_hashes =dynamic([“918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593”, “be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c”]);
_Im_WebSession(starttime=todatetime(in the past(lookback)), endtime=now())
| the place DstIpAddr in (ioc_ip_addr) or FileSHA256 in (ioc_sha_hashes)
| summarize imWS_mintime=min(TimeGenerated), imWS_maxtime=max(TimeGenerated),
EventCount=depend() by SrcIpAddr, DstIpAddr, Url, Dvc, EventProduct, EventVendor
Detect area and URL indicators of compromise utilizing ASIM
The next question checks area and URL IOCs throughout knowledge sources supported by ASIM net session parser:
// file hash checklist - imFileEvent
// Area checklist - _Im_WebSession
let ioc_domains = dynamic(["https://213.145.86.112/t/pixel.gif", "https://213.145.86.112/cdn/chunks/polyfill-7e2b.min.js", "https://213.145.86.112/t/event"]);
_Im_WebSession (url_has_any = ioc_domains)
ChocoShell C2 communications
The next question detects ChocoShell communications with its C2 server utilizing HTTPS with URI paths designed to mix in with professional net visitors. Beacons use /t/pixel.gif?m=
let lookback = 30d;
let ioc_url_artifacts = dynamic(["/t/pixel.gif?m="]);
_Im_WebSession(starttime=todatetime(in the past(lookback)), endtime=now())
| the place DstDomain in (ioc_url_artifacts)
| summarize imWS_mintime=min(TimeGenerated), imWS_maxtime=max(TimeGenerated),
EventCount=depend() by SrcIpAddr, DstIpAddr, Url, Dvc, EventProduct, EventVendor
Indicators of compromise
| Indicator | Sort | Description | First seen |
| ms365-device[.]com | Area | CaptiveCrunch DCF redirect | 2026-07-23 |
| ms365-live[.]com | Area | CaptiveCrunch DCF redirect | 2026-05-14 |
| m365-owa[.]com | Area | CaptiveCrunch AitM infrastructure | 2026-07-20 |
| owa-ms365[.]com | Area | CaptiveCrunch AitM infrastructure | 2026-07-16 |
| 31.57.243[.]154 | IP tackle | CaptiveCrunch AitM infrastructure | 2026-07-16 |
| 38.146.28[.]75 | IP tackle | CaptiveCrunch AitM infrastructure | 2026-07-01 |
| 38.146.28[.]132 | IP tackle | CaptiveCrunch DNS Resolver | 2026-07-15 |
| 104.194.159[.]150 | IP tackle | CaptiveCrunch AitM infrastructure | 2026-04-28 |
| 107.189.26[.]194 | IP tackle | ChocoShell C2 / CaptiveCrunch DNS Resolver | 2026-02-27 |
| 213.145.86[.]112 | IP tackle | ChocoShell C2 | 2026-07-01 |
| 918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593 | File hash | CornFlake | 2026-07-03 |
| be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c | File hash | ChocoShell | 2026-07-10 |
References
Be taught extra
For the newest safety analysis from the Microsoft Risk Intelligence group, try the Microsoft Risk Intelligence Weblog.
To get notified about new publications and to hitch discussions on social media, observe us on LinkedIn, X (previously Twitter), and Bluesky.
To listen to tales and insights from the Microsoft Risk Intelligence group in regards to the ever-evolving menace panorama, hearken to the Microsoft Risk Intelligence podcast.
