SentinelOne Details How It Blocked APT29's CaptiveCrunch Campaign

SentinelOne Exposes APT29's "CaptiveCrunch" Campaign

SentinelOne published a technical breakdown of a Russian state-sponsored espionage campaign it calls CaptiveCrunch, attributed to APT29 — the group also tracked as Midnight Blizzard (Microsoft) and Cozy Bear, and best known for the 2020 SolarWinds supply-chain compromise. Rather than phishing emails or exploited internet-facing software, CaptiveCrunch relies on manipulating how Windows machines check for captive portals on local networks, redirecting that routine connectivity check into a malware delivery pipeline. SentinelOne says its Static AI engine convicted and blocked every payload the campaign attempted to drop, including on agents running software definitions nearly a year out of date.

Campaign Overview

How CaptiveCrunch Works

Hijacking the Captive-Portal Check

Windows devices routinely send an HTTP connectivity-check request to verify whether a network requires a captive-portal login (the familiar "sign in to this Wi-Fi" flow). CaptiveCrunch abuses this behavior at the local-network level:

1. An adversary-controlled spoofer, operating like the open-source tool Responder, broadcasts LLMNR responses on UDP/5355, racing the network's legitimate DNS resolver to answer name-resolution requests first.
2. When a victim's Windows connectivity check resolves to the attacker's address instead of the real captive-portal server, the attacker serves a page impersonating a browser updater prompt.
3. SentinelOne found this spoofing succeeded at rates ranging from 5.6% to 84%, depending on local network conditions — meaning the technique is opportunistic rather than guaranteed, but effective often enough to matter on shared or poorly segmented networks.

Payload Chain

Victims who accepted the fake updater received one of two tools:

• CornFlake — a Go-based remote access trojan providing keylogging, clipboard monitoring, screenshot and webcam/microphone capture, and persistence.
• ChocoShell — a memory-resident PowerShell infostealer that extracts browser cookies and Microsoft 365 authentication tokens, and disables AMSI (Windows' Antimalware Scan Interface) to evade detection.

SentinelOne also observed 49 token requests to Microsoft login domains occurring while DNS poisoning was active on affected segments — consistent with a credential-theft objective layered on top of the malware deployment.

Detection: Behavioral Hunting, Not Signatures

SentinelOne's researchers identified compromised hosts without relying on known file hashes or IOCs, instead correlating behavioral patterns:

• LLMNR/NBT-NS poisoning activity consistent with Responder-style tooling.
• A single IP address observed resolving domains across unrelated organizations — a strong indicator of shared adversary infrastructure rather than coincidence.
• Browser connectivity-check URLs appearing in process command lines, immediately followed by an executable download within 60 seconds.

On the prevention side, Static AI — SentinelOne's locally executed, model-based detection layer — convicted every CornFlake and ChocoShell sample "before it could execute," including partial .crdownload files still mid-transfer, within roughly 100 milliseconds of an execution attempt. Notably, this held even on endpoints running threat-intelligence definitions that were nearly a year stale, underscoring the value of on-device behavioral/ML detection that doesn't depend on fresh signature updates.

MITRE ATT&CK Techniques Observed

Scope

SentinelOne confirmed activity across three regions, spanning multiple affected environments, and noted that this specific combination of local-network DNS poisoning plus captive-portal lures had not previously been publicly documented for APT29 — suggesting the group is continuing to diversify its initial-access techniques beyond its more commonly reported phishing and supply-chain methods.

Key Takeaways

1. APT29/Midnight Blizzard used local-network LLMNR poisoning and fake captive-portal updater pages as an initial-access vector — not phishing or an exploited edge device.
2. Two custom payloads, CornFlake (Go RAT) and ChocoShell (PowerShell infostealer), were delivered, with the latter also disabling AMSI and harvesting Microsoft 365 tokens.
3. SentinelOne's Static AI blocked 100% of delivered payloads across all affected environments, including on agents with outdated threat definitions — behavioral/ML detection caught what signature freshness alone would have missed.
4. Defenders on shared or guest Wi-Fi segments should treat unexpected "update your browser" prompts following a captive-portal check as a red flag, and consider monitoring for LLMNR traffic and anomalous DNS resolution patterns on local network segments.

Sources

• How SentinelOne Blocked APT29's CaptiveCrunch Campaign — SentinelOne