Russian Hackers Target Hotel Wi-Fi With Microsoft 365 Malware

Microsoft has identified a global cyberattack campaign that leverages compromised hotel Wi-Fi networks to steal credentials for Microsoft 365 accounts. The threat actor behind this operation has been identified as Midnight Blizzard, also known by the designation APT29. This group is a Russian state-sponsored entity with a history of sophisticated espionage campaigns. The attacks specifically target individuals who connect to hotel Wi-Fi, a common practice for business travelers and tourists alike. By compromising these networks, Midnight Blizzard gains an entry point to intercept traffic and deploy malicious software designed to capture user login information.

The campaign's methodology involves setting up rogue Wi-Fi access points or compromising existing ones within hospitality establishments. Once a user connects to the infected network, the attackers can employ various techniques, including man-in-the-middle attacks, to intercept data. The ultimate goal is to obtain usernames and passwords for Microsoft 365, a widely used suite of productivity and collaboration tools that includes services like Outlook, Teams, and OneDrive. Access to these accounts can provide attackers with sensitive corporate information, facilitate further network intrusion, or enable espionage activities.

Microsoft's Threat Intelligence team has been actively monitoring this campaign, noting its global reach and its focus on high-value targets. The attribution to Midnight Blizzard, a group also associated with the Russian Foreign Intelligence Service (SVR), underscores the potential for state-sponsored espionage. This actor has previously been linked to attacks on government entities, think tanks, and other organizations deemed of strategic interest to Russia. The use of hotel Wi-Fi as an attack vector highlights the vulnerabilities inherent in public and semi-public networks, which are often less secure than private corporate networks.

To mitigate the risks associated with such attacks, Microsoft advises users to exercise extreme caution when connecting to public Wi-Fi networks, especially in hotels. Recommendations include using a Virtual Private Network (VPN) to encrypt internet traffic, ensuring multi-factor authentication (MFA) is enabled on all Microsoft 365 accounts, and being vigilant about phishing attempts or unusual login prompts. The company also emphasizes the importance of keeping operating systems and security software up to date. The ongoing nature of this campaign suggests that threat actors continue to find hotel Wi-Fi networks a viable and effective means to conduct their operations, posing a persistent risk to individuals and organizations relying on Microsoft 365 services.