Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
14 IOCs
CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft
Threat Actors
Malware Families
Excerpt
In this article The CaptiveCrunch campaign Storm-2945 and Midnight Blizzard CaptiveCrunch tradecraft and tooling How to protect against CaptiveCrunch activity Microsoft Defender detections and hunting guidance Indicators of compromise Since early May 2026, Microsoft Threat Intelligence has observed Storm-2945, a sub-cluster of Midnight Blizzard, conducting widespread but targeted traffic manipulation attacks involving hospitality sector networks served by captive portals…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →14 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593 | High | Score 83/100 | First seen |
| IP | 38.146.28.75 | High | Score 75/100 | First seen |
| IP | 31.57.243.154 | High | Score 75/100 | First seen |
| URL | https://213.145.86.112/cdn/chunks/polyfill-7e2b.min.js | High | Score 61/100 | First seen |
| IP | 38.146.28.132 | High | Score 72/100 | First seen |
| IP | 107.189.26.194 | High | Score 71/100 | First seen |
| Domain | owa-ms365.com | High | Score 77/100 | First seen |
| SHA256 | be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c | High | Score 83/100 | First seen |
| IP | 104.194.159.150 | High | Score 80/100 | First seen |
| Domain | m365-owa.com | High | Score 77/100 | First seen |
| URL | https://213.145.86.112/t/event | High | Score 62/100 | First seen |
| Domain | ms365-live.com | High | Score 75/100 | First seen |
| URL | https://213.145.86.112/t/pixel.gif | High | Score 58/100 | First seen |
| Domain | ms365-device.com | High | Score 77/100 | First seen |
IOC Relationship Graph
Building graph…