Cybersecurity experts have uncovered a new wave of cyber attacks exploiting public Wi-Fi networks to infiltrate corporate accounts. According to a report by ReliaQuest, hackers have targeted organizations operating captive portal networks to access Microsoft 365 accounts of employees on business trips.
DNS Manipulation and Credential Theft
The attackers employed a sophisticated method by altering the DNS settings of compromised small office/home office (SOHO) routers. This manipulation redirects users to malicious infrastructure controlled by the attackers, enabling them to capture login credentials.
These cyber activities have been ongoing since at least June 2026 and bear resemblance to the earlier FrostArmada campaign linked to APT28, a group associated with Russia’s GRU. The adversary-in-the-middle (AitM) technique used here allows interception and harvesting of sensitive information from unsuspecting victims.
Targeting Shared Venues Globally
ReliaQuest notes that the attacks have primarily targeted Wi-Fi gateways at shared venues such as hotels and conference centers. These incidents have been reported across the United States, India, and Saudi Arabia. Organizations providing captive Wi-Fi services, including airports and universities, are warned of similar vulnerabilities.
Analysis indicates that these attacks are not confined to specific sectors. Industries ranging from financial and legal to healthcare and retail have been affected, highlighting the indiscriminate nature of the campaign aimed at business travelers worldwide.
Distinctive Tactics and Infrastructure
The recent attacks differ from the FrostArmada campaign in their use of DNS poisoning, suggesting a potential deviation in sophistication or caution compared to APT28. The infrastructure, including domain registrations and IP addresses, does not match previously known APT28 activities.
The focus on captive portal appliances in public venues marks a new approach that wasn’t documented in prior campaigns. This shift in tactics requires organizations to enhance their security measures to protect against evolving threats.
ReliaQuest’s findings emphasize the need for heightened awareness and robust security frameworks to safeguard against these pervasive cyber threats. As the landscape of cyber attacks continues to evolve, organizations must adapt swiftly to protect their sensitive information.
