THREAT OPS › Threat News › CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft
CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft
<aside class="table-of-contents-block accordion wp-block-bloginabox-theme-table-of-contents" id="accordion-cf35a1aa-6fea-4b4e-8c64-a47b0bf5367c"> <button class="btn btn-collapse" type="button"> <span class="table-of-contents-block__label">In this article</span> <span class="table-of-contents-block__current"></span>
<svg class="table-of-contents-block__arrow" fill="none" height="11" viewBox
Attributed threat actors
MITRE ATT&CK techniques
- Scheduled TaskT1053.005
- Windows Management InstrumentationT1047
- Adversary-in-the-MiddleT1557
- IP AddressesT1590.005
- JavaScriptT1059.007
- Email CollectionT1114
- Windows ServiceT1543.003
- Component Object ModelT1559.001
- Social EngineeringT1684
- MasqueradingT1036
- Device RegistrationT1098.005
- PowerShellT1059.001
- Valid AccountsT1078
- Encrypted ChannelT1573
- Social MediaT1593.001
- CredentialsT1589.001
- ImpersonationT1684.001
- Conditional Access PoliciesT1556.009
- Remote Desktop ProtocolT1021.001
- CompressionT1027.015
- Wi-Fi NetworksT1669
- Valid AccountsAML.T0012
- ImpersonationAML.T0073
- MasqueradingAML.T0074
Indicators of compromise
- 918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593sha256
- be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42csha256
- https://reliaquest.com/blog/threat-spotlight-dns-poisoning-tactics-expand-to-hospitality/url
- https://213.145.86.112/t/eventurl
- 213.145.86.112ipv4
- 31.57.243.154ipv4
- 38.146.28.75ipv4
- 38.146.28.132ipv4
- 104.194.159.150ipv4
- 107.189.26.194ipv4
- msftconnecttest.comdomain
- msftncsi.comdomain
- connectivitycheck.gstatic.comdomain
- connectivitycheck.android.comdomain
- www.gstatic.comdomain
- detectportal.firefox.comdomain
- detectportal.brave-http-only.comdomain
- cloudflareportal.comdomain
- cloudflarecp.comdomain
- cloudflareok.comdomain
- connectivity.cloudflareclient.comdomain
- nmcheck.gnome.orgdomain
- ms365-device.comdomain
- ms365-live.comdomain
- m365-owa.comdomain
- owa-ms365.comdomain